Govee IoT takeover flaw patched server-side
A binding flaw in Govee cloud-connected devices allowed attackers to hijack devices remotely; vendor deployed server-side fixes and firmware updates for H6056 lamps.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2025-10910, a vulnerability in Govee's cloud platform that allows remote attackers to bind legitimate devices to attacker-controlled accounts. The flaw stems from a weak binding process where device association relies on a set of identifiers (device, SKU, type, and client-computed value) that lack cryptographic binding to device secrets. Successful exploitation grants full device control and removes the device from the legitimate owner's account.
The vulnerability was verified on Govee H6056 smart lamps running firmware 1.08.13, though other cloud-connected Govee models may be affected. Govee has deployed server-side security enhancements and pushed automatic firmware updates to most H6056 devices. Users with upgradeable hardware versions (not 1.00.10 or 1.00.11) must manually update via the Govee Home app if automatic patching failed. Devices with hardware versions 1.00.10 or 1.00.11 cannot receive the firmware update due to hardware limitations and remain vulnerable.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-10910
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs