CVE-2021-21955

A flaw in Anker Eufy Homebase 2 allows attackers to recover the device password by intercepting network traffic. An attacker on the same network can capture unencrypted information to bypass authentication and gain unauthorized access.

The get_aes_key_info_by_packetid() function in the home_security binary fails to properly protect encryption key information, allowing network sniffing to extract sensitive data used for authentication. An attacker with network access can passively intercept traffic to recover credentials without needing valid authentication, leading to unauthorized device control.