Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2025-8393

Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Dreame Technology Dreamehome iOS app

Default version status: unaffected

  • 0 to ≤ 2.3.4affected

Dreame Technology Dreamehome Android app

Default version status: unaffected

  • 0 to ≤ 2.1.8.8affected

Dreame Technology MOVAhome iOS app

Default version status: unaffected

  • 0 to ≤ 1.2.3affected

References