MEDIUM🇬🇧 English

CVE-2024-32928

CVSS 5.9v3.1pub. 2024-08-19upd. 2025-03-14

The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Google Nest Mini

    HW
    Google
    wszystkie wersje

  • Google Nest Mini Firmware

    OS
    Google
    wszystkie wersje

  • Haxx Libcurl

    APP
    Haxx
    wszystkie wersje
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2023-48419CRITICAL10.0PL ✓ten sam produkt

Privilege escalation w Google Home/Nest przez sieć Wi-Fi

CVE-2023-38545CRITICAL9.8ten sam produkt

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass a...

CVE-2021-22945CRITICAL9.1ten sam produkt

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep...

CVE-2019-3822CRITICAL9.8ten sam produkt

libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function cr...

CVE-2018-1000005CRITICAL9.1ten sam produkt

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was re...