# Dreame Home apps accept self-signed TLS certificates

Published: 2026-06-02 · Severity: routine · Sectors: telecommunications
Canonical: https://vorant.io/reports/9782b976-fa31-51ee-8b6b-a0a3d901045a/dreame-home-apps-accept-self-signed-tls-certificates

> TLS validation flaw in Dreame and MOVAhome mobile apps enables man-in-the-middle attacks on untrusted networks.

Dreame Technology's iOS and Android mobile applications for managing connected devices contain a TLS certificate validation vulnerability (CVE-2025-8393). The affected apps accept self-signed certificates during TLS communication, creating an attack surface on untrusted networks such as public WiFi. An attacker positioned on the network could intercept traffic and capture user credentials and session tokens. The vulnerability affects Dreamehome iOS app version 2.3.4 and earlier, Dreamehome Android app version 2.1.8.8 and earlier, and MOVAhome iOS app version 1.2.3 and earlier. MOVA is a subsidiary of Dreame Technology.

Dreame has released updated versions implementing proper SSL certificate validation and removing unencrypted communications. CISA reports no known public exploitation of this vulnerability. The flaw is not remotely exploitable; an attacker must be present on the target's network. Users should upgrade to the latest versions of the affected applications. The vulnerability is rooted in improper certificate validation (CWE-295) and affects organizations worldwide that deploy these device-management apps in critical infrastructure sectors including communications.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8393

## Detection guidance (public sample)

### Linux ARP Spoofing Tool Execution for Adversary-in-the-Middle

ATT&CK: T1557.002

Detects execution of common ARP cache poisoning tools (arpspoof, ettercap in ARP mode, bettercap with arp.spoof) on Linux, the positioning step for the on-network interception the report describes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Linux ARP Spoofing Tool Execution for Adversary-in-the-Middle
description: Detects execution of ARP cache poisoning tooling on Linux (arpspoof,
  ettercap with ARP mitm mode, bettercap arp.spoof module). An attacker on the same
  network segment uses these to intercept TLS traffic from apps that accept self-signed
  certificates.
tags:
- attack.credential-access
- attack.collection
- attack.t1557
- attack.t1557.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_arpspoof:
    Image|endswith: /arpspoof
  selection_ettercap:
    Image|endswith: /ettercap
    CommandLine|contains:
    - ' arp'
    - M arp
  selection_bettercap:
    Image|endswith: /bettercap
    CommandLine|contains: arp.spoof
  condition: 1 of selection_*
falsepositives:
- Authorized penetration tests or red team exercises run from Linux hosts
- Security training labs demonstrating ARP spoofing
level: high
id: a67a464f-00f8-5624-aa64-9729b43ac5f4
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
```

### Windows ARP Spoofing or MITM Tool Execution

ATT&CK: T1557.002

Detects ettercap or bettercap running on Windows with ARP poisoning arguments, used to man-in-the-middle traffic on a shared network. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows ARP Spoofing or MITM Tool Execution
description: Detects ettercap or bettercap launched on Windows with ARP spoofing arguments,
  a common way to get an adversary-in-the-middle position on a local network.
tags:
- attack.credential-access
- attack.collection
- attack.t1557
- attack.t1557.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_ettercap:
    Image|endswith: \ettercap.exe
    CommandLine|contains:
    - ' arp'
    - M arp
  selection_bettercap:
    Image|endswith: \bettercap.exe
    CommandLine|contains: arp.spoof
  condition: 1 of selection_*
falsepositives:
- Authorized penetration testing or red team activity from Windows workstations
- Network security staff validating ARP inspection controls
level: high
id: a49609b3-f05e-57cd-a82e-077afd11f67c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9782b976-fa31-51ee-8b6b-a0a3d901045a/dreame-home-apps-accept-self-signed-tls-certificates.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup