{"id":"CVE-2026-107051","kind":"vulnerability","aliases":["CVE-2026-107051"],"related":[],"title":"AndFHEM Android app: insecure permissions let attackers change other users' home automation settings","description":"Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.","summary":"AndFHEM v2.4.1, an Android client for the FHEM home-automation server, has insecure permissions that let an unauthorized attacker change another user's FHEM control configuration. The attacker gains the ability to alter home-automation controls belonging to someone else.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["andfhem","android","fhem","home-automation","package"],"not_affected_if":["other-app-versions"],"how_to_check":"- Check the installed AndFHEM version in the app's settings or with `adb shell dumpsys package <package name>` and look for versionCode `241`","fix":null,"status":"open","published_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:07+00:00","updated_at":"2026-10-29T17:28:07+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T17:28:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"AndFHEM Android app: insecure permissions let attackers change other users' home automation settings","impact":"medium","summary":"AndFHEM v2.4.1, an Android client for the FHEM home-automation server, has insecure permissions that let an unauthorized attacker change another user's FHEM control configuration. The attacker gains the ability to alter home-automation controls belonging to someone else.","audience":"everyone","category":"package","nicknames":[],"who_cares":["andfhem","android","fhem","home-automation"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker alters another user's home automation control configuration","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107051 for CVSS, attack vector and any fixed version of AndFHEM.","how_to_check":"- Check the installed AndFHEM version in the app's settings or with `adb shell dumpsys package <package name>` and look for versionCode `241`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-app-versions"],"who_is_affected":"Affects the AndFHEM Android app at version 2.4.1 (versionCode 241) that connects to FHEM home-automation controls. The sources do not say which configurations or deployments are exposed beyond the description, so whether a given install is at risk is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4103,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107051':16A,19A '-2026':15A,18A '241':76C 'abil':58B 'allow':80C 'alter':60B 'andfhem':1A,20B,27B,73C 'android':2A,21B,30B 'anoth':48B,86C 'app':3A 'arbitrarili':84C 'attack':7A,46B,55B,82C 'autom':12A,25B,37B,63B,92C 'belong':65B 'build':79C 'chang':8A,47B 'client':31B 'configur':53B,94C 'control':52B,64B,93C 'cve':14A,17A 'els':68B 'fhem':22B,34B,51B,89C 'gain':56B 'home':11A,24B,36B,62B,91C 'home-autom':23B,35B,61B,90C 'insecur':4A,40B,69C 'klassm':72C 'let':6A,43B 'manipul':85C 'packag':26B 'permiss':5A,41B,70C 'server':38B 'set':13A 'someon':67B 'unauthor':45B,81C 'user':10A,49B,87C 'v2.4.1':28B,74C 'verifi':78C 'versioncod':75C","nicknames":[],"mitigations":[],"who_affected":"Affects the AndFHEM Android app at version 2.4.1 (versionCode 241) that connects to FHEM home-automation controls. The sources do not say which configurations or deployments are exposed beyond the description, so whether a given install is at risk is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T17:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107051","severity":null,"published_at":"2026-10-29T17:17:57+00:00","modified_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}