CVE-2024-7205

sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user PUBLISHED

Description (CNA)

When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.

Affected (CNA)

Vendor / product	Versions
CoolKit / eWeLink Cloud Service	affected 2.0.0 before 2.19.0

CWE

CWE-201

References

https://ewelink.cc/security-advisory-240730/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.