Vulnerability · Published Aug 8, 2025 · Assigned by icscert
CVE-2025-8393Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation
High 7.3
In plain English
A high-severity improper certificate validation in Dreamehome Android app from Dreame Technology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.1%top 97.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dreame Technology | Dreamehome iOS app | 0 – through 2.3.4 |
| Dreame Technology | Dreamehome Android app | 0 – through 2.1.8.8 |
| Dreame Technology | MOVAhome iOS app | 0 – through 1.2.3 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N