CVE-2021-21953

An authentication bypass vulnerability exists in the processmsg function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges...

CVE-2021-21952

An authentication bypass vulnerability exists in the CMDDEVICEGETRSAKEYREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges...

Authentication flaw

An authentication bypass vulnerability exists in the processmsg function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges...

CVE-2021-21953

An authentication bypass vulnerability exists in the processmsg function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges...

CVE-2021-21953

The connected TALOS advisory confirms CVE-2021-21953 affects Anker Eufy Homebase 2, version 2.1.6.9h, where the home_security binary’s process_msg() enables an authentication bypass. The attack is MITM-capable over UDP, and the vulnerability arises because protocol traffic can be tampered to issu...

CVE-2021-21952

An authentication bypass vulnerability exists in the CMDDEVICEGETRSAKEYREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges...

CVE-2021-21952

The connected TALOS advisory confirms CVE-2021-21952 affects Anker Eufy Homebase 2, binary home_security, via an authentication bypass in CMD_DEVICE_GET_RSA_KEY_REQUEST. The exploit chain begins with an unauthenticated CMD_DEVICE_GET_RSA_KEY_REQUEST that triggers a flawed RSA/AES key exchange: th...

CVE-2021-21952: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability exists in the CMDDEVICEGETRSAKEYREQUEST functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges...

CVE-2021-21953: Channel Accessible by Non-Endpoint

An authentication bypass vulnerability exists in the processmsg function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges...

Anker Eufy Homebase recv_server_device_response_msg_process Code Execution

The vulnerability of the “recvserverdeviceresponsemsgprocess” function in Anker Eufy Homebase surveillance systems arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code on the target system...

Anker Eufy Homebase wifi_country_code_update Heap Buffer Overflow DoS

The vulnerability of the wifiCountryCodeUpdate function in Anker Eufy Homebase software exists because measures are not taken to neutralize the special commands used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands by...

CVE-2021-21954

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

CVE-2021-21955

An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2021-21954

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

CVE-2021-21955

An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2021-21955

An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2021-21954

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

Authentication flaw

An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2021-21955

An authentication bypass vulnerability exists in the getaeskeyinfobypacketid function of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2021-21955

The CVE refers to Anker Eufy Homebase 2 (2.1.6.9h) in the home_security get_aes_key_info_by_packetid() authentication bypass. TALOS details show the weakness: the function combines the 0x10-byte randomly generated AES secret with the decimal time of the device into an output secret, then overwrit...