CVE-2023-47353 is a download-without-integrity-check flaw in the IMOU GO Android app, version 1.0.11. NVD scores it 8.8, High. A component named DownloadFirmwareService can be made to download an attacker's file. No fixed version is confirmed in the sources I read, so check the app store for an update.
What's affected
The record names IMOU GO version 1.0.11 for Android, package com.dahua.imou.go. The affected component is com.oneed.dvr.service.DownloadFirmwareService. No fixed version is named in the record or in the researcher write-up. Check the app listing on Google Play for a newer release and read its notes.
Source conflict on the attack path: the NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which says network attack with user interaction. The researcher write-up describes a different route: a malicious app already installed on the same device supplies the firmware address to the exported service. Those two readings differ on how the attacker gets in, and the NVD severity should be read with that in mind.
The record lists CWE-494, download of code without integrity check. The write-up also names CWE-20, improper input validation.
How to check if you're exposed
On an Android device, open Settings, then Apps, then IMOU GO, and read the version. Version 1.0.11 is the one named in the record.
If you manage devices through a mobile device management tool, filter the app inventory for the package name com.dahua.imou.go and note the version. Also check whether other apps of unknown origin are installed on the same devices, because the write-up describes a local app as the trigger.
I am not giving a command line check, because the package manager output differs by device and policy.
What to do now
- Open the app listing and install any newer version than 1.0.11. Read the update notes for a mention of this issue.
- If no update is available, consider removing the app from devices that handle sensitive data, until the vendor publishes a fix.
- Remove apps you do not recognise from the device, and install apps only from the official store.
- Keep the camera or recorder firmware updated through the vendor's own supported channel, not through any third party.
- Add the app package to your mobile app inventory so you hear about the next advisory.
Why it matters
The core weakness is CWE-494. A component that fetches firmware takes the location of the file from an incoming request and does not check who sent it or whether the file is genuine. If the content is later treated as trusted code, whoever controls the address controls what runs.
The write-up lists arbitrary code execution and a compromised device state as the potential impact if a malicious file is accepted. I could not verify that outcome independently, and I am relying on the researcher's description. The NVD score of 8.8 reflects the worst case of high impact on confidentiality, integrity and availability.
The fix pattern for this class is well known: verify a signature or hash of anything downloaded before using it, and do not let other apps choose where it comes from. Android apps can also mark internal components as not exported, so only the app itself can call them. Whether the vendor has applied either is not stated in the sources I read.
Quick check
Does this affect other versions of IMOU GO?
The record names only 1.0.11. Newer or older builds are not listed, so check the vendor's notes for each build you run.
Is a proof of concept public?
The researcher write-up includes sample code. This post does not repeat it.
Sources
- Researcher write-up for IMOU GO 1.0.11
- IMOU GO on Google Play
- Safeguard Gold page for CVE-2023-47353
Last reviewed: 19 October 2026.
