No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
Credit: Dennis Giese
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-8393 | CWE-295 Improper Certificate Validation | 7.3 High |
A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens. Vendor fix: Dreame has updated their mobile app to remove unencrypted communications and implement SSL certificate based secure communication. Users should upgrade to the most current version of the mobile application. Mitigation: Contact Dreame Technology directly for more information. Note that MOVA is a subsidiary of Dreame Technology. ↗ Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-8393 | 7.3 High | Dreame Technology Dreamehome iOS app A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when … |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.