Critical

Unauthorized device binding in Govee cloud-connected devices

IdentifiersCVE-2025-10910CWE-639· Authorization Bypass Through…

CVE-2025-10910 is a server-side authorization flaw in the device binding process used by Govee cloud-connected devices. The issue allows a remote attacker to associate an already-online device with the attacker’s own Govee account by supplying device identifiers such as "device", "sku", "type", and a client-computed "value" that are accepted by the backend without being cryptographically bound to a secret originating from the physical device. As a result, the binding workflow does not adequately verify that the party requesting association is the legitimate owner or is in possession of device-derived proof. The vulnerability has been verified on the Govee H6056 lamp running firmware 1.08.13, and may affect additional Govee cloud-connected models.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to take over an online vulnerable device at the cloud-account level. The attacker can bind the device to their own account, gain full control over device functionality exposed through the Govee platform, and cause the device to be removed from the legitimate owner’s account. This results in loss of ownership, unauthorized remote operation, and denial of control to the legitimate user. Depending on the affected device type, this may also enable persistent unauthorized access until the device is recovered or reset and rebound.

Mitigation

If you can’t patch tonight, do this now.

Apply the vendor-provided firmware update and ensure the device remains connected so automatic or manual updates can complete. Monitor Govee security announcements for additional affected models and backend-side mitigations. For H6056 hardware versions 1.00.10 and 1.00.11, which cannot receive the firmware update due to hardware limitations, the practical mitigation is device replacement, as no patch path is available. Where feasible, reduce exposure by disabling or avoiding cloud binding features until patched and by monitoring accounts/devices for unexpected ownership changes or rebinding events.

Remediation

Patch, then assume compromise.

Govee has deployed server-side security enhancements and automatic firmware updates for model H6056. Users of H6056 devices should update to the patched firmware immediately through the Govee Home app while the device remains Wi-Fi connected. The documented update path is: open the Govee Home app, select the H6056 device card, open settings, navigate to Device Information / Firmware Version, and install the available update. Administrators and users should also monitor vendor advisories for additional affected models because the vendor has indicated that other cloud-connected devices may be impacted. Devices that cannot receive security updates due to hardware or support limitations should be replaced.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cvefeed high severityNews

Dec 18, 2025

CVE-2025-10910 - Gaining remote control over Govee devices

A critical authorization bypass vulnerability in Govee cloud-connected devices allows remote attackers to take full control of devices by binding them to attacker accounts, due to weak device association mechanisms in the cloud API.

cert polskaNews

Dec 18, 2025

Vulnerability in Govee devices with cloud connectivity firmware

A remote authorization bypass in Govee H6056 (and possibly other Govee cloud-connected devices) allows attackers to take control of devices by binding them to attacker accounts, due to insufficient cryptographic binding in the device association process.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2025-10910

NVD

nvd.nist.gov/vuln/detail/CVE-2025-10910

MITRE CWE · CWE-639

Authorization Bypass Through User-Controlled Key

cert.pl

cert.pl/en/posts/2025/12/CVE-2025-10910

Unauthorized device binding in Govee cloud-connected devices

IdentifiersCVE-2025-10910CWE-639· Authorization Bypass Through…