CVE-2021-27941

4.6 mediumEPSS 0.2%

Medium (4.6) in coolkit ewelink. EPSS 0.2% chance of exploitation in the next 30 days.

Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 on Android and through 4.9.1 on iOS) allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during a device pairing process.

Severity

CVSS 3.1

4.6 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2021-05-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

coolkit:ewelink

References

https://apps.apple.com/us/app/ewelink-smart-home/id1035163158
https://github.com/salgio/eWeLink-QR-Code
https://play.google.com/store/apps/details?id=com.coolkit&hl=en_US
https://apps.apple.com/us/app/ewelink-smart-home/id1035163158
https://github.com/salgio/eWeLink-QR-Code

Check your stack JSON