CVE-2024-7206

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

Metrics

CVSS 4.0 7.0/10CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295CWE-798

Affected software

VendorProductVersions
eWeLinkZigbee Bridge Pro<= 2.0.0

References

Timeline

Published
Oct 8, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-72086.5A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass securitCVE-2024-72096.5A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization tCVE-2024-72116.1The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting CVE-2024-72128.8A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function CVE-2024-72138.8A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268_B20220504. Affected is the function setWizardCfgCVE-2024-72148.8A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the funCVE-2024-72158.8A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHostCVE-2024-72165.3A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /CVE-2024-72178.8A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginautCVE-2024-72186.1A flaw has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.CVE-2024-72199.8A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown fuCVE-2024-72209.8A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this issue is some unknown functionality
CVE-2024-7206: High severity, CVSS 7.0 | Vulnix