Description
A TLS vulnerability exists in the phone application used to manage a
connected device. The phone application accepts self-signed certificates
when establishing TLS communication which may result in
man-in-the-middle attacks on untrusted networks. Captured communications
may include user credentials and sensitive session tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dreame Technology | Dreamehome iOS app | ≤ 2.3.4 | — |
| Dreame Technology | Dreamehome Android app | ≤ 2.1.8.8 | — |
| Dreame Technology | MOVAhome iOS app | ≤ 1.2.3 | — |
Advisories 1
- ICSA-25-219-06 Dreame Technology iOS and Android Mobile Applications (Update A) CISA ICS & IT advisories · Jun 2, 2026