Google Chromecast Firmware vulnerabilities

6 CVEs affecting Google Chromecast Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-48426, published 2024-04-05.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-12716, published 2018-06-25. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine…
• CVE-2023-6181, published 2023-12-11. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. An oversight in BCB handling of reboot reason that allows for persistent code execution
• CVE-2023-48425, published 2023-12-11. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. U-Boot vulnerability resulting in persistent Code Execution 
• CVE-2023-48424, published 2023-12-11. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. U-Boot shell vulnerability resulting in Privilege escalation in a production device
• CVE-2023-48417, published 2023-12-11. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application
• CVE-2023-48426, published 2024-04-05. Critical severity, CVSS 10.0. EPSS: 0.2% chance of exploitation in the next 30 days. u-boot bug that allows for u-boot shell and interrupt over UART