VDB
CVE-2018-12716
CVE-2018-12716
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request.
EPSS 0.70% · 51.5th percentile
Risk Scores
CVSS 3.0
4.300000190734863
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score
0.70%
51.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| home_firmware | ||
| chromecast_firmware | ||
| n/a | n/a | n/a |
Timeline
- Jun 25, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 27, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Mar 2, 2022 EPSS Score
- May 4, 2022 EPSS Score
- Jul 6, 2022 EPSS Score
- Sep 8, 2022 EPSS Score
- Nov 10, 2022 EPSS Score
- Jan 12, 2023 EPSS Score
References
- https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/ url
- https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/ url
- https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 url
- https://nvd.nist.gov/vuln/detail/CVE-2018-12716 advisory
- https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast url
- https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 url
- https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home url
- https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability url
- https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/ advisory