Vulnerability-Lookup

CVE-2025-10910 (GCVE-0-2025-10910)

Vulnerability from cvelistv5 – Published: 2025-12-18 11:21 – Updated: 2025-12-19 19:04

Title

Gaining remote control over Govee devices

Summary

A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server‑side API allows device association using a set of identifiers: "device", "sku", "type", and a client‑computed "value", that are not cryptographically bound to a secret originating from the device itself. The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is investigating other potentially affected models. The vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately. Govee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-18 14:40 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

CERT-PL ENISA root Scorecard

References

1 reference

URL	Tags
https://cert.pl/en/posts/2025/12/CVE-2025-10910/

Impacted products

1 product

Vendor	Product	Version
Govee	H6056	Affected: 1.08.13 (custom)

Credits

Jan Adamski (NASK - PIB) Marek Janiszewski (NASK - PIB)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T14:40:37.275880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T14:42:00.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "firmware"
          ],
          "product": "H6056",
          "vendor": "Govee",
          "versions": [
            {
              "status": "affected",
              "version": "1.08.13",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jan Adamski (NASK - PIB)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Marek Janiszewski (NASK - PIB)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\u003cbr\u003eThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\u003cbr\u003e\u003cbr\u003eThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u0026nbsp;The vendor is investigating other potentially affected models.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\u003c/span\u003e\u003cbr\u003e \u003cbr\u003eGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations.\u0026nbsp;"
            }
          ],
          "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u00a0The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T19:04:00.404Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Gaining remote control over Govee devices",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2025-10910",
    "datePublished": "2025-12-18T11:21:21.272Z",
    "dateReserved": "2025-09-24T11:01:15.618Z",
    "dateUpdated": "2025-12-19T19:04:00.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-10910",
      "date": "2026-10-01",
      "epss": "0.00389",
      "percentile": "0.30585"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "modules": [
                  "firmware"
                ],
                "product": "H6056",
                "vendor": "Govee",
                "versions": [
                  {
                    "status": "affected",
                    "version": "1.08.13",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "cvd@cert.pl"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u00a0The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations."
          },
          {
            "lang": "es",
            "value": "Una falla en el proceso de vinculaci\u00f3n de la plataforma en la nube y los dispositivos de Govee permite a un atacante remoto vincular un dispositivo Govee existente y en l\u00ednea a la cuenta del atacante, lo que resulta en el control total del dispositivo y la eliminaci\u00f3n del dispositivo de la cuenta de su propietario leg\u00edtimo.\nLa API del lado del servidor permite la asociaci\u00f3n de dispositivos utilizando un conjunto de identificadores: \u0027device\u0027, \u0027sku\u0027, \u0027type\u0027, y un \u0027value\u0027 calculado por el cliente, que no est\u00e1n vinculados criptogr\u00e1ficamente a un secreto originado desde el propio dispositivo.\n\nLa vulnerabilidad ha sido verificada para el dispositivo Govee H6056 - l\u00e1mpara en la versi\u00f3n de firmware 1.08.13, pero tambi\u00e9n puede afectar a otros dispositivos Govee conectados a la nube. El proveedor est\u00e1 investigando otros modelos potencialmente afectados.\n\nEl proveedor ha implementado mejoras de seguridad del lado del servidor y actualizaciones autom\u00e1ticas de firmware para el modelo H6056. La mayor\u00eda de los dispositivos H6056 han sido parcheados exitosamente a trav\u00e9s de actualizaciones autom\u00e1ticas. Los usuarios restantes de H6056 con versiones de hardware actualizables deben actualizar manualmente el firmware a trav\u00e9s de la aplicaci\u00f3n Govee Home mientras mantienen su dispositivo conectado a WiFi. Los usuarios deben abrir la aplicaci\u00f3n Govee Home, tocar la tarjeta de su dispositivo H6056 para ingresar a la p\u00e1gina de detalles del dispositivo, tocar el icono de configuraci\u00f3n en la esquina superior derecha, navegar a la secci\u00f3n Informaci\u00f3n del Dispositivo (Versi\u00f3n de Firmware), y tocar el bot\u00f3n Actualizar para instalar el parche de seguridad inmediatamente.\n\nLos dispositivos Govee H6056 con versiones de hardware 1.00.10 o 1.00.11 no pueden recibir la actualizaci\u00f3n de firmware debido a limitaciones de hardware."
          }
        ],
        "id": "CVE-2025-10910",
        "lastModified": "2026-09-30T23:10:00.237",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "cvd@cert.pl",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-10910",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T14:40:37.275880Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-18T12:16:07.963",
        "references": [
          {
            "source": "cvd@cert.pl",
            "url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910/"
          }
        ],
        "sourceIdentifier": "cvd@cert.pl",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "cvd@cert.pl",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-10910",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-18T14:40:37.275880Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-18T14:41:26.070Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "modules": [
                "firmware"
              ],
              "product": "H6056",
              "vendor": "Govee",
              "versions": [
                {
                  "status": "affected",
                  "version": "1.08.13",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Jan Adamski (NASK - PIB)"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Marek Janiszewski (NASK - PIB)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\u003cbr\u003eThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\u003cbr\u003e\u003cbr\u003eThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u0026nbsp;The vendor is investigating other potentially affected models.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\u003c/span\u003e\u003cbr\u003e \u003cbr\u003eGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations.\u0026nbsp;"
                }
              ],
              "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u00a0The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-19T19:04:00.404Z",
            "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
            "shortName": "CERT-PL"
          },
          "references": [
            {
              "url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Gaining remote control over Govee devices",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "assignerShortName": "CERT-PL",
        "cveId": "CVE-2025-10910",
        "datePublished": "2025-12-18T11:21:21.272Z",
        "dateReserved": "2025-09-24T11:01:15.618Z",
        "dateUpdated": "2025-12-19T19:04:00.404Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-264199

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:01

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:01:47.530089+00:00",
  "id": "EUVD-2026-264199"
}

FKIE_CVE-2025-10910

Vulnerability from fkie_nvd - Published: 2025-12-18 12:16 - Updated: 2026-09-30 23:10

Severity

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	cvd@cert.pl	https://cert.pl/en/posts/2025/12/CVE-2025-10910/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "firmware"
          ],
          "product": "H6056",
          "vendor": "Govee",
          "versions": [
            {
              "status": "affected",
              "version": "1.08.13",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cvd@cert.pl"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u00a0The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations."
    },
    {
      "lang": "es",
      "value": "Una falla en el proceso de vinculaci\u00f3n de la plataforma en la nube y los dispositivos de Govee permite a un atacante remoto vincular un dispositivo Govee existente y en l\u00ednea a la cuenta del atacante, lo que resulta en el control total del dispositivo y la eliminaci\u00f3n del dispositivo de la cuenta de su propietario leg\u00edtimo.\nLa API del lado del servidor permite la asociaci\u00f3n de dispositivos utilizando un conjunto de identificadores: \u0027device\u0027, \u0027sku\u0027, \u0027type\u0027, y un \u0027value\u0027 calculado por el cliente, que no est\u00e1n vinculados criptogr\u00e1ficamente a un secreto originado desde el propio dispositivo.\n\nLa vulnerabilidad ha sido verificada para el dispositivo Govee H6056 - l\u00e1mpara en la versi\u00f3n de firmware 1.08.13, pero tambi\u00e9n puede afectar a otros dispositivos Govee conectados a la nube. El proveedor est\u00e1 investigando otros modelos potencialmente afectados.\n\nEl proveedor ha implementado mejoras de seguridad del lado del servidor y actualizaciones autom\u00e1ticas de firmware para el modelo H6056. La mayor\u00eda de los dispositivos H6056 han sido parcheados exitosamente a trav\u00e9s de actualizaciones autom\u00e1ticas. Los usuarios restantes de H6056 con versiones de hardware actualizables deben actualizar manualmente el firmware a trav\u00e9s de la aplicaci\u00f3n Govee Home mientras mantienen su dispositivo conectado a WiFi. Los usuarios deben abrir la aplicaci\u00f3n Govee Home, tocar la tarjeta de su dispositivo H6056 para ingresar a la p\u00e1gina de detalles del dispositivo, tocar el icono de configuraci\u00f3n en la esquina superior derecha, navegar a la secci\u00f3n Informaci\u00f3n del Dispositivo (Versi\u00f3n de Firmware), y tocar el bot\u00f3n Actualizar para instalar el parche de seguridad inmediatamente.\n\nLos dispositivos Govee H6056 con versiones de hardware 1.00.10 o 1.00.11 no pueden recibir la actualizaci\u00f3n de firmware debido a limitaciones de hardware."
    }
  ],
  "id": "CVE-2025-10910",
  "lastModified": "2026-09-30T23:10:00.237",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cvd@cert.pl",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-10910",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-18T14:40:37.275880Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-18T12:16:07.963",
  "references": [
    {
      "source": "cvd@cert.pl",
      "url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910/"
    }
  ],
  "sourceIdentifier": "cvd@cert.pl",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "cvd@cert.pl",
      "type": "Secondary"
    }
  ]
}

GHSA-7FJ8-G5X7-M9V3

Vulnerability from github – Published: 2025-12-18 12:30 – Updated: 2025-12-19 21:30

Details

The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is not able to provide a list of affected products, but rolls out a firmware and server-side fixes. Devices that reached end‑of‑life for security support need replacement with newer models supporting updates.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-10910"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-18T12:16:07Z",
    "severity": "CRITICAL"
  },
  "details": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices. The vendor is not able to provide a list of affected products, but rolls out a firmware and server-side fixes. Devices that reached end\u2011of\u2011life for security support need replacement with newer models supporting updates.",
  "id": "GHSA-7fj8-g5x7-m9v3",
  "modified": "2025-12-19T21:30:18Z",
  "published": "2025-12-18T12:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10910"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-10910 (GCVE-0-2025-10910)

EUVD-2026-264199

FKIE_CVE-2025-10910

GHSA-7FJ8-G5X7-M9V3

Tags

Sightings

Nomenclature

Related by attack behaviour