Nanoleaf records
4 published records for vendor Nanoleaf.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-295 Improper Certificate Validation1
- CWE-400 Uncontrolled Resource Consumption1
- CWE-732 Incorrect Permission Assignment for Critical Resource1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
4 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2022-46640No exploit | Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP requestnanoleaf · nanoleaf desktop · CWE-77 | Critical9.8 | 1.8%Apr 18, 2023 |
39Monitor | CVE-2022-47758No exploit | Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.nanoleaf · nanoleaf firmware · CWE-295 | Critical9.8 | 1.1%Apr 26, 2023 |
30Monitor | CVE-2023-42189No exploit | Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee Lnanoleaf · lightstrip firmware · CWE-732 | High7.5 | 1.0%Oct 9, 2023 |
30Monitor | CVE-2023-45955No exploit | An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commannanoleaf · lightstrip firmware · CWE-400 | High7.5 | 0.7%Oct 31, 2023 |
- CVE-2022-4664040Plan
Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request
CriticalCVSS 9.8No exploitEPSS 1%nanoleaf · nanoleaf desktopApr 18, 2023
- CVE-2022-4775839Monitor
Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
CriticalCVSS 9.8No exploitEPSS 1%nanoleaf · nanoleaf firmwareApr 26, 2023
- CVE-2023-4218930Monitor
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee L
HighCVSS 7.5No exploitEPSS 1%nanoleaf · lightstrip firmwareOct 9, 2023
- CVE-2023-4595530Monitor
An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute comman
HighCVSS 7.5No exploitEPSS 0%nanoleaf · lightstrip firmwareOct 31, 2023