Dreame Home apps accept self-signed TLS certificates
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
TLS validation flaw in Dreame and MOVAhome mobile apps enables man-in-the-middle attacks on untrusted networks.
Dreame Technology's iOS and Android mobile applications for managing connected devices contain a TLS certificate validation vulnerability (CVE-2025-8393). The affected apps accept self-signed certificates during TLS communication, creating an attack surface on untrusted networks such as public WiFi. An attacker positioned on the network could intercept traffic and capture user credentials and session tokens. The vulnerability affects Dreamehome iOS app version 2.3.4 and earlier, Dreamehome Android app version 2.1.8.8 and earlier, and MOVAhome iOS app version 1.2.3 and earlier. MOVA is a subsidiary of Dreame Technology.
Dreame has released updated versions implementing proper SSL certificate validation and removing unencrypted communications. CISA reports no known public exploitation of this vulnerability. The flaw is not remotely exploitable; an attacker must be present on the target's network. Users should upgrade to the latest versions of the affected applications. The vulnerability is rooted in improper certificate validation (CWE-295) and affects organizations worldwide that deploy these device-management apps in critical infrastructure sectors including communications.
Mentioned in this report
Detection guidance
Linux ARP Spoofing Tool Execution for Adversary-in-the-Middle
Detects execution of common ARP cache poisoning tools (arpspoof, ettercap in ARP mode, bettercap with arp.spoof) on Linux, the positioning step for the on-network interception the report describes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux ARP Spoofing Tool Execution for Adversary-in-the-Middle
description: Detects execution of ARP cache poisoning tooling on Linux (arpspoof,
ettercap with ARP mitm mode, bettercap arp.spoof module). An attacker on the same
network segment uses these to intercept TLS traffic from apps that accept self-signed
certificates.
tags:
- attack.credential-access
- attack.collection
- attack.t1557
- attack.t1557.002
logsource:
category: process_creation
product: linux
detection:
selection_arpspoof:
Image|endswith: /arpspoof
selection_ettercap:
Image|endswith: /ettercap
CommandLine|contains:
- ' arp'
- M arp
selection_bettercap:
Image|endswith: /bettercap
CommandLine|contains: arp.spoof
condition: 1 of selection_*
falsepositives:
- Authorized penetration tests or red team exercises run from Linux hosts
- Security training labs demonstrating ARP spoofing
level: high
id: a67a464f-00f8-5624-aa64-9729b43ac5f4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
Windows ARP Spoofing or MITM Tool Execution
Detects ettercap or bettercap running on Windows with ARP poisoning arguments, used to man-in-the-middle traffic on a shared network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows ARP Spoofing or MITM Tool Execution
description: Detects ettercap or bettercap launched on Windows with ARP spoofing arguments,
a common way to get an adversary-in-the-middle position on a local network.
tags:
- attack.credential-access
- attack.collection
- attack.t1557
- attack.t1557.002
logsource:
category: process_creation
product: windows
detection:
selection_ettercap:
Image|endswith: \ettercap.exe
CommandLine|contains:
- ' arp'
- M arp
selection_bettercap:
Image|endswith: \bettercap.exe
CommandLine|contains: arp.spoof
condition: 1 of selection_*
falsepositives:
- Authorized penetration testing or red team activity from Windows workstations
- Network security staff validating ARP inspection controls
level: high
id: a49609b3-f05e-57cd-a82e-077afd11f67c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs