Description (CNA)
A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Dreame Technology / Dreamehome iOS app | affected 0 through 2.3.4 |
| Dreame Technology / Dreamehome Android app | affected 0 through 2.1.8.8 |
| Dreame Technology / MOVAhome iOS app | affected 0 through 1.2.3 |
CWE
CWE-295
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
- https://support.dreametech.com/hc/en-us
ADP enrichment
No English description supplied.
No references supplied.