| Govee H6199 Smart LED Strip (H6199)
|
|
Security Grade
Calculator vv1
|
Govee H6199 Smart LED Strip
Release Date: 2021-04-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Small controller enclosure is easy to access; no public report of exposed debug interfaces for this model.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
CVE-2025-10910 (CVSS 9.3 Critical): a flaw in the Govee cloud binding process lets a remote attacker bind an online device to their own account and remove the legitimate owner. The vendor states other cloud-connected devices may also be affected.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
EPSS 0.35%, not listed in CISA or EU KEV; SSVC marks the issue as automatable, so the residual risk is not negligible.
|
| Updatability
|
Rare
|
🔗 Proof
|
Hardware versions 1.00.10 and 1.00.11 cannot receive firmware updates due to hardware limitations; other users must update manually through the Govee Home app.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The server-side API allows device association using device, sku, type and a client-computed value that are not cryptographically bound to a secret originating from the device (CWE-639).
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
App and cloud traffic use TLS; the reported flaw is in the binding logic rather than the transport.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest on the device.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The legitimate owner loses control when an attacker binds the device to another account.
|
| Authentication
|
Basic
|
🔗 Proof
|
Binding lacks a device-side secret check, so authentication can be bypassed with user-controlled values.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout on the Govee cloud API.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
No complete access audit log documented; device removal events are not surfaced to the owner.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Access depends on the Govee Home cloud account; no device-local password policy.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: Govee Home)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: 12 V DC adapter • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11 b/g/n, Bluetooth LE
|
| Physical (Dimensions & Mass)
|
Dimensions: 5 m strip with controller • Mass: approx. 250 g
|
Overall assessment: The decisive issue is CVE-2025-10910 (CVSS 9.3), a flaw in the Govee cloud binding logic that lets a remote attacker claim an online device and evict its rightful owner. Transport security is not the problem - app and cloud traffic use TLS - but the binding API accepts values that are not cryptographically bound to a device-held secret (CWE-639). Updatability is the second weakness: hardware revisions 1.00.10 and 1.00.11 cannot be patched at all, and other units require a manual update in the Govee Home app. EPSS remains low (0.35%) and the issue is not in CISA or EU KEV, so real-world exploitation is not confirmed.
