MEDIUM🇵🇱 Wersja polska

CVE-2024-32928

CVSS 5.9v3.1pub. 2024-08-19upd. 2025-03-14

The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Google Nest Mini

    HW
    Google
    all versions

  • Google Nest Mini Firmware

    OS
    Google
    all versions

  • Haxx Libcurl

    APP
    Haxx
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-48419CRITICAL10.0PL ✓same product

Privilege escalation w Google Home/Nest przez sieć Wi-Fi

CVE-2023-38545CRITICAL9.8PL ✓same product

Heap buffer overflow w libcurl podczas handshake z proxy SOCKS5

CVE-2021-22945CRITICAL9.1PL ✓same product

Double-free w libcurl przy wysyłaniu danych do serwera MQTT

CVE-2019-3822CRITICAL9.8PL ✓same product

Stack-based buffer overflow w libcurl podczas obsługi NTLM type-3

CVE-2018-1000005CRITICAL9.1PL ✓same product

libcurl: odczyt poza granicami bufora przy obsłudze nagłówków HTTP/2