CVE-2023-37822 is a high severity (CVSS 8.2) flaw in the Eufy Homebase 2. The device builds a private Wi-Fi network whose WPA2 password comes only from the serial number, so it can be guessed offline in seconds. The record says firmware before 3.3.4.1h is affected, so update the Homebase.
What's affected
The NVD record says the Eufy Homebase 2 is affected before firmware version 3.3.4.1h. It lists the firmware and the hardware product with no other version limits. The record scores the flaw 8.2 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. That means the attacker must be on the adjacent network, here meaning within Wi-Fi range, needs no account and no user action, and the scope is changed.
The weakness is CWE-331 (insufficient entropy). The record explains it this way. The Homebase 2 creates a dedicated wireless network for its ecosystem, which acts as a proxy to the owner's main network. The WPA2 key for that network is generated only from the serial number, and the record says it can be brute forced offline within seconds.
The USENIX WOOT 2024 paper behind the record, from researchers at KU Leuven, says the vulnerabilities were responsibly disclosed and confirmed by Eufy and could allow unauthorized access to the end user's private network within seconds. The abstract does not state fixed firmware versions, so use the record's 3.3.4.1h and confirm in Eufy's own update notes. The record does not flag CISA KEV status.
How to check if you're exposed
This is a consumer device, so there is no package manager to query. Open the Eufy Security app, select the Homebase 2, and look at its device information or settings for the firmware version. Compare it with 3.3.4.1h. A lower number is in the affected range.
You can also check whether the Homebase is set up in a way that creates its own Wi-Fi network, as described in the record. If the device is in a home office or small business, it counts as a way into the main network.
For organizations that allow staff or visitors to bring smart home devices into offices, a wireless survey for networks named for such devices is a practical way to find them.
What to do now
- Check the firmware version of each Eufy Homebase 2 in the Eufy Security app.
- Update the firmware to the latest version the app offers, which should be at least 3.3.4.1h, and then confirm the version number again.
- If an update is not possible, consider switching the device off or moving it away from networks you care about until it is updated.
- Make sure the main network behind the Homebase is itself protected by a strong password, and treat any device on it as reachable from the Homebase side.
- If the device is in an office, record it in your asset list so it is covered by your patch checks.
Why it matters
The research is a good example of a weak key by design. Cryptographic keys need unpredictable input. When a key comes only from a value like a serial number, the number of possible keys is small and an attacker who can guess or read the serial can try them all offline, without ever touching the device. Sequential or printed serial numbers make this easier still.
The part that raises the score is the proxy role. The dedicated network is a bridge to the owner's main network, so breaking the weak key gives a position on the real network, not just on the device. Proximity is the only requirement, which turns a parking lot or a neighbouring flat into a place to attack from. Keep IoT firmware on your patch list like any other system.
Quick check
Do I need to be on the same network to be attacked?
You need to be near the device. The record says the only requirement is proximity to the dedicated wireless network, with no account and no user action.
Which firmware fixes it?
The record says versions before 3.3.4.1h are affected. The paper page does not list a fixed version, so confirm in the Eufy app or Eufy support notes.
Sources
- USENIX WOOT 2024 presentation page
- Research paper (PDF) (linked from the record; we read the presentation page, not the full paper)
- CVE-2023-37822 on Gold
Last reviewed: 19 October 2026.
