Read the docs
TI-2023-04259 Aliases CVE-2023-4617GHSA-59pp-rvhc-93rh

Gaining remote control over Govee devices

Priority MEDIUM 50CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values.  This issue affects Govee Home applications on Android and iOS in versions before 5.9.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00607 49th percentileScored 2026-11-07
Fix Fixed Govee Home (Govee): 5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoveeGovee Homebefore 5.95.9Patch availableCNA
GoveeGovee Homebefore 5.95.9Patch availableCNA
  • Govee Home VendorGovee Affected before 5.9 Fixed in 5.9 Patch available CNA
  • Govee Home VendorGovee Affected before 5.9 Fixed in 5.9 Patch available CNA

Remediation

  • Fix · CNA Govee Home (Govee) Fixed in 5.9
  • Fix · CNA Govee Home (Govee) Fixed in 5.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4617
  2. 2026-10-03 Alias added: GHSA-59pp-rvhc-93rh

References

Advisory 2

Other 2

  • TI-2025-09990 Gaining remote control over Govee devices CVSS 4.0CRITICAL 9.3
  • TI-2023-22515 Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK… CVSS 3.1HIGH 7.5
  • TI-2023-24671 An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of… CVSS 3.1HIGH 7.5
  • TI-2023-03371 Unprotected WebView access in Govee Home App CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences