CVE-2024-7206 - CVE House
Back to Database
Status published High CVE-2024-7206

Firmware extraction and Hardware SSL Pinning Bypass

Vulnerability Description

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7206

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Aarav Sinha, Senior Security Researcher, FEV India Pvt Ltd.
  • Jerin Sunny, Security Researcher, FEV India Pvt Ltd.
  • Shakir Zari,Security Researcher,FEV India Pvt Ltd.

References

Affected Vendor

Affected Software

Zigbee Bridge Pro
Vulnerable Versions:
0

Timeline

Official Publish: October 8th, 2024
Last Modified: October 8th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-295 CWE-798

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation