CVE-2021-21955

The CVE refers to Anker Eufy Homebase 2 (2.1.6.9h) in the home_security get_aes_key_info_by_packetid() authentication bypass. TALOS details show the weakness: the function combines the 0x10-byte randomly generated AES secret with the decimal time of the device into an output secret, then overwrit...

CVE-2021-21954

CVE-2021-21954 affects Anker Eufy Homebase 2 (home_security binary) via wifi_country_code_update. The vulnerable code parses a JSON field country_code and injects it into the shell command (iwpriv ra0 set CountryCode=%s) without sanitization, leading to arbitrary command execution as root when th...

CVE-2021-21951

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function readudppushconfigfile. A specially-crafted network packet can lead to code execution...

CVE-2021-21950

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function recvserverdeviceresponsemsgprocess. A specially-crafted network packet can lead to code execution...

Cross site scripting

An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h in function recvserverdeviceresponsemsgprocess. A specially-crafted network packet can lead to code execution...

CVE-2021-21951

CVE-2021-21951 affects Anker Eufy Homebase 2 (binary home_security, 2.1.6.9h). A crafted CMD_DEVICE_GET_SERVER_LIST_REQUEST (and related read_udp_push_config_file handling) triggers an out-of-bounds write, via unvalidated nums/domainN fields, enabling a write-what-where that can lead to code exec...

Eufy Anker Eufy Homebase 2 Authentication Bypass Vulnerability (CNVD-2022-00623)

Anker Eufy Homebase is a wireless home security camera system from Eufy U.S. An authentication bypass vulnerability exists in Anker Eufy Homebase 2 version 2.1.6.9h, which can be exploited by attackers to sniff network traffic leading to password recovery...

Eufy Anker Eufy Homebase 2 Authentication Bypass Vulnerability

Anker Eufy Homebase is a wireless home security camera system from Eufy U.S. An authentication bypass vulnerability exists in Eufy Anker Eufy Homebase 2, which could be exploited by attackers to elevate privileges...

Anker Eufy Homebase 2 OS Command Injection Vulnerability

The Anker Eufy Homebase 2 is a wireless home security camera system from Eufy USA. The Anker Eufy Homebase 2 suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands via specially crafted network packets...

Eufy Anker Eufy Homebase 缓冲区错误漏洞

Anker Eufy Homebase is a wireless home security camera system from Eufy U.S.A. A buffer overflow vulnerability exists in Anker Eufy Homebase 2 version 2.1.6.9h, which can be exploited by attackers to cause code execution...

Anker Eufy Homebase 安全漏洞

Anker Eufy Homebase is a wireless home security camera system from Eufy U.S. An authentication bypass vulnerability exists in Eufy Anker Eufy Homebase 2, which could be exploited by attackers to elevate privileges...

Anker Eufy Homebase 2 home_security process_msg() authentication bypass vulnerability

Talos Vulnerability Report TALOS-2021-1380 Anker Eufy Homebase 2 homesecurity processmsg authentication bypass vulnerability November 29, 2021 CVE Number CVE-2021-21953 SUMMARY An authentication bypass vulnerability exists in the processmsg function of the homesecurity binary of Anker Eufy Homeba...

Anker Eufy Homebase 2 home_security CMD_DEVICE_GET_RSA_KEY_REQUEST authentication bypass vulnerability

Talos Vulnerability Report TALOS-2021-1379 Anker Eufy Homebase 2 homesecurity CMDDEVICEGETRSAKEYREQUEST authentication bypass vulnerability November 29, 2021 CVE Number CVE-2021-21952 SUMMARY An authentication bypass vulnerability exists in the CMDDEVICEGETRSAKEYREQUEST functionality of the...

Anker Eufy Homebase 2 home_security get_aes_key_info_by_packetid() authentication bypass vulnerability

Talos Vulnerability Report TALOS-2021-1382 Anker Eufy Homebase 2 homesecurity getaeskeyinfobypacketid authentication bypass vulnerability November 29, 2021 CVE Number CVE-2021-21955 SUMMARY An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity...

Eufy Anker Eufy Homebase 操作系统命令注入漏洞

The Anker Eufy Homebase 2 is a wireless home security camera system from Eufy USA. The Anker Eufy Homebase 2 suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands via specially crafted network packets...

Anker Eufy Homebase 2 home_security CMD_DEVICE_GET_SERVER_LIST_REQUEST out-of-bounds write vulnerability

Talos Vulnerability Report TALOS-2021-1378 Anker Eufy Homebase 2 homesecurity CMDDEVICEGETSERVERLISTREQUEST out-of-bounds write vulnerability November 29, 2021 CVE Number CVE-2021-21950,CVE-2021-21951 SUMMARY An out-of-bounds write vulnerability exists in the CMDDEVICEGETSERVERLISTREQUEST...

CVE-2021-21940

A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network packet can lead to a heap buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

Heap overflow

A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network packet can lead to a heap buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...

Design/Logic Flaw

A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to remote code execution...

CVE-2021-21941

A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to remote code execution...