HomeIntelligenceBrief
VULNERABILITY BRIEF🟠 High Vulnerability

Command Injection RCE Discovered in Home Assistant Green’s go2rtc Component (CVE‑2025‑XXXX)

A CVSS 7.5 command‑injection flaw in Home Assistant Green’s go2rtc process allows root‑level code execution after localhost access; the issue underscores the need for SOC 2‑aligned input‑validation and patch‑evidence controls.

LiveThreat™ Intelligence · 📅 August 13, 2026· 📰 zerodayinitiative.com
🟠
Severity
High
VU
Type
Vulnerability
🎯
Confidence
High
🏢
Affected
1 sector(s)
Actions
2 recommended
📰
Source
zerodayinitiative.com

Command Injection RCE Discovered in Home Assistant Green’s go2rtc Component (CVE‑2025‑XXXX)

What Happened — A remote‑code‑execution (RCE) flaw (CVSS 7.5) was found in the go2rtc process used by Home Assistant Green. An attacker who can reach the device’s localhost interface can inject a crafted string that the process executes as a system call, gaining root‑level code execution. The issue was patched in go2rtc v1.9.14 and the corresponding Home Assistant release.

Why It Matters for Compliance & Audit Readiness

  • The vulnerability exemplifies a control gap in input validation that SOC 2’s CC6.1 – System Operations and CC7.1 – Change Management controls are designed to detect and remediate.
  • Continuous evidence of secure coding practices and timely patch deployment is required to demonstrate due diligence during a SOC 2 audit.
  • Verisq’s Control Mapping capability can automatically map this type of code‑level defect to the relevant SOC 2 criteria and collect remediation evidence for auditors.

Who Is Affected – Smart‑home/IoT vendors, managed service providers delivering Home Assistant deployments, and any organization that runs Home Assistant Green in a corporate or residential environment.

Recommended Actions

  • Verify that all Home Assistant Green instances are running go2rtc v1.9.14 or later.
  • If you cannot upgrade immediately, isolate the device from any network that can reach its localhost interface and apply host‑based firewall rules.
  • Document the remediation in your change‑management log and capture the patch version as audit evidence.
  • Incorporate input‑validation testing into your secure‑development lifecycle (SDLC) controls.

Source: Zero Day Initiative advisory

Technical Notes

  • CVSS 7.5 – AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack vector: Network‑adjacent attacker must first obtain localhost access, then exploit unchecked command‑line arguments in go2rtc.
  • Impact: Arbitrary code execution as root, potential full device takeover.
  • Fix: go2rtc v1.9.14 and updated Home Assistant release (see GitHub).
📰 Original Source
http://www.zerodayinitiative.com/advisories/ZDI-26-561/

This LiveThreat Intelligence Brief is an independent analysis. Read the original reporting at the link above.

From the Verisq platform · Trust Operations

Every gap like this maps to a control you can evidence.

The Verisq AI Trust Operations platform maps incidents to your control framework and collects the evidence continuously — so your Trust Center shows proof, not promises, when a buyer or auditor asks.

Explore the Verisq AI Trust Operations platform →