A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to remote code execution.
A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product’s behavior during the switch.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Eufy_homebase_2_firmware | Anker | 2.1.6.9h (including) | 2.1.6.9h (including) |