CVE-2023-37822: High severity Eufy Homebase 2 Firmware vulnerability
The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation process, the WPA2-PSK can be brute forced offline within seconds. This vulnerability allows an attacker in proximity to the dedicated wireless network to gain unauthorized access to the end user's primary network. The only requirement of the attack is proximity to the dedicated wireless network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eufy Homebase 2to a version that resolves this vulnerability.Fixed in 3.3.4.1h - Compensating control
Limit access to the Eufy Homebase 2 dedicated wireless network (the ecosystem network that proxies to the end user's primary network) to reduce the impact of offline WPA2-PSK brute forcing by attackers in proximity.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37822?
CVE-2023-37822 is classified as a high-severity vulnerability due to its potential impact on network security and user privacy.
How do I fix CVE-2023-37822?
To fix CVE-2023-37822, users must update the Eufy Homebase 2 firmware to version 3.3.4.1h or later.
What is the impact of CVE-2023-37822?
CVE-2023-37822 can allow unauthorized access to a user's primary network due to flaws in the wireless network's WPA2-PSK generation.
Who does CVE-2023-37822 affect?
CVE-2023-37822 affects Eufy Homebase 2 devices running firmware versions prior to 3.3.4.1h.
What type of vulnerability is CVE-2023-37822?
CVE-2023-37822 is a security vulnerability related to inadequate wireless network security settings.