Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Nanoleaf records in CISA KEVNo Nanoleaf vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority HIGH 82
Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01195 · Published 2023-04-27 · No fix listed CWE-295
Priority HIGH 82
Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0186 · Published 2023-04-18 · No fix listed CWE-77
Priority MEDIUM 41
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01024 · Published 2023-10-10 · No fix listed CWE-732
Priority MEDIUM 40
An issue discovered in Nanoleaf Light strip v3.5.10 allows attackers to cause a denial of service via crafted write binding attribute commands.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00718 · Published 2023-10-31 · No fix listed CWE-400
Priority LOW 36
Nanoleaf Lines 12.3.2 does not authenticate firmware file uploads.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00354 · Published 2026-03-25 · Fixed in 12.3.6 CWE-400
THREATIST.IORead the docs