Command Injection RCE Discovered in Home Assistant Green’s go2rtc Component (CVE‑2025‑XXXX)
What Happened — A remote‑code‑execution (RCE) flaw (CVSS 7.5) was found in the go2rtc process used by Home Assistant Green. An attacker who can reach the device’s localhost interface can inject a crafted string that the process executes as a system call, gaining root‑level code execution. The issue was patched in go2rtc v1.9.14 and the corresponding Home Assistant release.
Why It Matters for Compliance & Audit Readiness
- The vulnerability exemplifies a control gap in input validation that SOC 2’s CC6.1 – System Operations and CC7.1 – Change Management controls are designed to detect and remediate.
- Continuous evidence of secure coding practices and timely patch deployment is required to demonstrate due diligence during a SOC 2 audit.
- Verisq’s Control Mapping capability can automatically map this type of code‑level defect to the relevant SOC 2 criteria and collect remediation evidence for auditors.
Who Is Affected – Smart‑home/IoT vendors, managed service providers delivering Home Assistant deployments, and any organization that runs Home Assistant Green in a corporate or residential environment.
Recommended Actions
- Verify that all Home Assistant Green instances are running go2rtc v1.9.14 or later.
- If you cannot upgrade immediately, isolate the device from any network that can reach its localhost interface and apply host‑based firewall rules.
- Document the remediation in your change‑management log and capture the patch version as audit evidence.
- Incorporate input‑validation testing into your secure‑development lifecycle (SDLC) controls.
Source: Zero Day Initiative advisory
Technical Notes
- CVSS 7.5 – AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network‑adjacent attacker must first obtain localhost access, then exploit unchecked command‑line arguments in
go2rtc. - Impact: Arbitrary code execution as root, potential full device takeover.
- Fix: go2rtc v1.9.14 and updated Home Assistant release (see GitHub).