Home Assistant Green Vulnerability Allows Command Injection and Remote Code Execution

The Zero Day Initiative has disclosed a critical command injection vulnerability, designated ZDI-26-560, affecting Home Assistant Green devices. This flaw, which carries a CVSS score of 7.5, enables network-adjacent attackers to execute arbitrary code on vulnerable systems.

To exploit this vulnerability, an attacker must first gain the ability to access the device's localhost interface. This prerequisite limits the direct attack surface but does not diminish the severity of the potential compromise once access is established. The vulnerability resides within the go2rtc component, a crucial part of Home Assistant's real-time communication capabilities.

The root cause of the issue lies in the improper validation of user-supplied input before it is used in a system call. This oversight allows an attacker to inject malicious commands that are then executed by the operating system with elevated privileges. Successful exploitation grants the attacker the ability to execute code in the context of the 'root' user, providing complete control over the affected Home Assistant Green device.

Home Assistant Green is a dedicated hardware device designed to run Home Assistant, a popular open-source home automation platform. Its primary function is to provide a centralized and user-friendly interface for managing smart home devices. Vulnerabilities that allow for remote code execution on such devices are particularly concerning, as they could be leveraged to gain access to a user's home network, control smart devices, or pivot to other systems within the network.

While the Zero Day Initiative has disclosed the vulnerability, specific details regarding patches or mitigation efforts from the Home Assistant team are not immediately available in this advisory. Users are advised to monitor official Home Assistant security advisories for any updates or recommended actions. The nature of the vulnerability suggests that network segmentation and restricting localhost access where possible could serve as interim mitigation strategies.

This discovery underscores the ongoing security challenges faced by Internet of Things (IoT) devices and smart home platforms. As these devices become more integrated into our daily lives, the potential impact of security flaws grows significantly. The ability for an attacker to gain root-level access to a device controlling a home's infrastructure presents a substantial risk to user privacy and security.

Further technical details are expected to be released as the vulnerability matures, potentially including proof-of-concept exploits. Security professionals and Home Assistant users should remain vigilant for any new information that could aid in detection or prevention of exploitation attempts. The implications of this vulnerability highlight the importance of timely security patching and robust input validation in software development, especially for devices managing sensitive home environments.

This new advisory, ZDI-26-562, details a separate server-side request forgery (SSRF) vulnerability affecting Home Assistant Green devices. Unlike the previously reported command injection flaw in the go2rtc component, this SSRF vulnerability targets the mDNS service and allows network-adjacent attackers to initiate arbitrary server-side requests without authentication, with a CVSS score of 5.4.

This new advisory from Zero Day Initiative details a separate Server-Side Request Forgery (SSRF) vulnerability, ZDI-26-563, affecting Home Assistant Green. Unlike the previously reported command injection flaw (ZDI-26-560), this SSRF vulnerability does not require authentication and allows network-adjacent attackers to initiate arbitrary requests by exploiting improper URI validation in the Simple Service Discovery Protocol handling. While the previous vulnerability could lead to remote code execution, this SSRF flaw can be leveraged in conjunction with other vulnerabilities to achieve root-level code execution.

This advisory from Zero Day Initiative details vulnerability ZDI-26-561, which affects the go2rtc component within Home Assistant Green. The vulnerability requires network adjacency and prior localhost access to exploit, allowing for remote code execution as root. The CVSS score for this flaw is rated at 7.5.