What’s Vulnerable › Vulnerabilities

CVE-2025-8393: Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-08 · updated 2026-06-17
• Weakness: CWE-295

Description

A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive session tokens.

Affected products

• Dreame Technology Dreamehome Android app: through 2.1.8.8
• Dreame Technology Dreamehome iOS app: through 2.3.4
• Dreame Technology MOVAhome iOS app: through 1.2.3

References

• https://support.dreametech.com/hc/en-us
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06

Get alerted when CVE-2025-8393 or the next vulnerability affects your stack