CVE-2023-42470

9.8 criticalEPSS 2.5%

Critical (9.8) in imoulife life. EPSS 2.5% chance of exploitation in the next 30 days.

The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. This relates to the com.mm.android.easy4ip.MainActivity activity. JavaScript execution is enabled in the WebView, and direct web content loading occurs.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2023-09-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

imoulife:life

References

https://github.com/actuator/cve/blob/main/CVE-2023-42470
https://github.com/actuator/imou/blob/main/imou-life-6.8.0.md
https://github.com/actuator/imou/blob/main/poc.apk
https://github.com/actuator/cve/blob/main/CVE-2023-42470
https://github.com/actuator/imou/blob/main/imou-life-6.8.0.md

Check your stack JSON