CVE-2024-51346
Published: 25 March 2026
Summary
CVE-2024-51346 is a high-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Eufy Homebase (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 4.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-51346 is a vulnerability in Eufy Homebase 2 version 3.3.4.1h that allows a local attacker to obtain sensitive information through a flaw in the cryptographic scheme. This issue corresponds to CWE-330 (Use of Insufficiently Random Values) and has a CVSS v3.1 base score of 7.7 (High), with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high impacts on confidentiality and integrity but no availability impact.
A local attacker can exploit this vulnerability with low complexity, requiring no privileges or user interaction. Successful exploitation enables the attacker to access sensitive information and potentially modify data, given the high integrity impact rating.
For mitigation details, security practitioners should consult the primary advisory at https://github.com/victorGoeman/Eufy-Ecosystem-Security-Research/blob/main/CVE-2024-51346.md and the related research repository at https://github.com/victorGoeman/Eufy-Ecosystem-Security-Research/blob/main/README.md, along with the vendor site at https://www.eufy.com/. No official patches are detailed in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55498
Vulnerability details
An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local crypto flaw (weak RNG) directly enables unauthorized extraction of sensitive data/credentials from the device without privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires cryptographic protections using FIPS-validated modules that ensure sufficient randomness, directly countering the CWE-330 flaw in the cryptographic scheme allowing sensitive information disclosure.
Mandates timely remediation of identified flaws like this cryptographic vulnerability in Eufy Homebase 2 firmware, preventing local attacker exploitation.
Enforces cryptographic key establishment and management with sufficient entropy, mitigating aspects of insufficiently random values in the flawed scheme.