A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product’s behavior during the switch.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Eufy_homebase_2_firmware | Anker | 2.1.8.5h (including) | 2.1.8.5h (including) |