Medium severity · published Jun 25, 2018
CVE-2018-12716
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote…
4.3
CVSS
0.7%
EPSS
No
On KEV
Description
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Chromecast Firmware · Google
All versions, or not specified · source: NVD
HF
Home Firmware · Google
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-12716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-12716
Issue Tracking
https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/
medium.com
https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
Third Party Advisory
https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/
Third Party Advisory
https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/
More from Chromecast Firmware
10.0
CVE-2023-48426
u-boot bug that allows for u-boot shell and interrupt over UART
9.8
CVE-2023-6181
An oversight in BCB handling of reboot reason that allows for persistent code execution
9.8
CVE-2023-48425
U-Boot vulnerability resulting in persistent Code Execution
9.8
CVE-2023-48424
U-Boot shell vulnerability resulting in Privilege escalation in a production device
9.8
CVE-2023-48417
Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application