CVE-2018-12716 is a DNS rebinding vulnerability affecting Google Home and Chromecast devices released before mid-July 2018. This flaw allows remote attackers on the same local network to extract Wi-Fi scan results from the devices. The extracted data, specifically BSSID fields, can then be used with the Google Maps Geolocation API to determine the physical location of web browsers on the network. The vulnerability has a CVSS score of 4.3 (Medium), indicating an adjacent attack vector with low impact on confidentiality and no impact on integrity or availability. Its low EPSS score and FAUCET Risk Score suggest a low likelihood of exploitation in the wild. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has received no community discussion or media coverage, further indicating a lack of widespread attention or active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:google:chromecast_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:google:home_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.