After Year-Long Silence, Dreame Patches Smart Home Apps Vulnerable to Credential-Theft Attacks

Dreame Technology has finally released a patch for its popular smart home applications after researchers exposed a certificate validation flaw that left millions of users defenseless against man-in-the-middle (MITM) attacks. The update, detailed in CISA’s revised advisory on June 2, 2026, removes unencrypted communications and enforces proper SSL certificate checking—a year after the original disclosure and after the vendor initially ignored coordination requests. This long-overdue fix addresses CVE-2025-8393, a high-severity vulnerability affecting the Dreamehome and MOVAhome mobile apps, which control vacuum cleaners, robot mops, and other connected home devices used worldwide.

The flaw, rated 7.3 on the CVSS v3 scale, allowed attackers on the same Wi-Fi network to intercept login credentials, session tokens, and device commands simply by presenting a forged self-signed certificate. With no initial response from Dreame, the burden of defense fell squarely on users and network administrators. The saga underscores persistent weaknesses in IoT supply chain security and the urgent need for enforceable vendor accountability.

A Vulnerability Born of Poor Certificate Hygiene

At its core, CVE-2025-8393 is an improper certificate validation issue (CWE-295). When users opened the Dreamehome or MOVAhome apps on their smartphones and connected to backend servers over TLS, the apps failed to verify that the server’s certificate was issued by a trusted authority. Instead, they accepted any self-signed certificate, no matter how dubious. This critical oversight opened a direct channel for MITM attacks on any untrusted network—coffee shop Wi-Fi, airport hotspots, or even compromised corporate guest networks.

Security researcher Dennis Giese, who reported the vulnerability to CISA, demonstrated that an attacker could effortlessly set up a rogue access point or use ARP spoofing to position themselves between the victim’s phone and Dreame’s servers. By presenting a fake certificate, they could establish an encrypted tunnel that the app believes is legitimate, all while siphoning sensitive data in plaintext form. The attack required no special privileges or user interaction beyond simply running the app.

Because these apps serve as the primary control interface for connected devices, the exposure went far beyond simple passwords. Session tokens—the digital keys that keep users logged in—could be captured and reused to impersonate the victim remotely, potentially granting an attacker full control over smart home devices from anywhere in the world. The ramifications ranged from unauthorized surveillance to outright sabotage of cleaning schedules and home automation routines.

Affected Versions and Global Reach

CISA’s advisory originally published on August 7, 2025, affected three app versions across two brands:

Dreame Technology, headquartered in China, markets its devices globally. The company’s products—including robot vacuums, cordless stick vacs, and wet/dry mops—are sold in over 100 countries. The companion apps have been downloaded tens of millions of times on Google Play and Apple’s App Store, making the exposure footprint enormous. MOVA is a Dreame subsidiary, meaning the flaw rippled through both ecosystems.

A Year of Silence and Shifting Blame

The timeline of this vulnerability is as troubling as the technical flaw itself. According to CISA, the agency attempted to coordinate disclosure with Dreame Technology after Giese’s report but received no response. The initial advisory, marked “Update A” status pending, simply advised users to minimize network exposure and employ VPNs—a workaround that did nothing to fix the root cause. For enterprise environments running fleets of smart devices, the lack of a patch posed a persistent security headache.

Dreame’s silence fueled frustration within the security community. Forum discussions on WindowsNews.ai and elsewhere highlighted the broader implications: “This lack of collaboration is particularly concerning for a company involved in critical communication sectors,” one user wrote. Others pointed out that improper certificate validation is a well-known, easily avoided mistake, suggesting a systemic failure in the company’s development and quality assurance processes. The episode also intensified scrutiny of Chinese-developed software, especially in light of geopolitical tensions and supply chain concerns.

It wasn’t until June 2, 2026—nearly ten months after the public disclosure—that CISA updated the advisory to confirm that Dreame had “updated their mobile app to remove unencrypted communications and implement SSL certificate based secure communication.” The statement urged users to upgrade to the most current version but did not specify which version numbers contained the fix. This lack of transparency forced security-conscious users to manually verify whether their apps had been updated, a tedious process that many found unacceptable.

How the Attack Works in Practice

To understand the real-world danger, consider a typical scenario: A Dreame robot vacuum owner, using the Dreamehome app on their Android phone, connects to a hotel’s free Wi-Fi. An attacker on the same network—using readily available tools like Bettercap or a rogue hotspot—intercepts the initial TLS handshake between the app and Dreame’s cloud server. Because the app does not verify the certificate’s authenticity, it accepts the attacker’s self-signed certificate. From that moment, every piece of data transmitted—login credentials, session cookies, device status, and even cleaning maps—flows through the attacker’s machine.

Once in possession of a valid session token, the attacker does not need to remain on the same network. They can use the token to authenticate to Dreame’s API from anywhere, issuing commands to the vacuum, accessing historical data, and potentially pivoting to other linked smart home accounts. While no public exploitation has been documented as of this writing, the low complexity and high impact make it a prime candidate for inclusion in automated attack toolkits.

Mitigation Then and Now: A User’s Guide

Before the patch, the only defense was network-level isolation. CISA recommended placing control systems behind firewalls, using VPNs for remote access, and avoiding public Wi-Fi altogether when operating the apps. These measures remain good practice, but they were always a bandage, not a cure. Now that a patch exists, the priority shifts to ensuring every user and organization updates immediately.

Immediate actions for users:

• Check your app version: On iOS, go to Settings > General > iPhone Storage, find Dreamehome or MOVAhome, and check the version. On Android, go to Settings > Apps, select the app, and scroll to the bottom. If your version is at or below those listed in the table, update from the official app store right away.
• Verify the fix: After updating, look for a release note or changelog mentioning “improved security” or “SSL certificate validation.” If in doubt, contact Dreame support directly via their support page.
• Enable automatic updates: To prevent future out-of-date software, turn on auto-updates for apps on your device.
• Continue to avoid untrusted networks: Even with the patch, using any app on public Wi-Fi carries risks. Stick to cellular data or a trusted VPN whenever you manage smart home devices remotely.

For IT administrators overseeing fleets of Dreame or MOVA devices, the patch alone is not enough. Network segmentation remains critical. Isolate IoT devices on a dedicated VLAN with strict access controls, and monitor for anomalous TLS traffic that could indicate attempted interception. Document your update procedures and ensure that all employee-owned devices that access company networks are running the latest app versions.

Industry-Wide Lessons: IoT Security Is Still a Mess

The Dreame incident is not an isolated misstep. It reflects a broader pattern in the smart home industry, where convenience often trumps security. Certificate validation failures, hardcoded credentials, and unencrypted communications are among the most common vulnerability classes reported to CISA’s ICS-CERT each year. The fact that a major vendor took nearly a year to address a high-severity bug speaks to a systemic lack of accountability.

Regulators are taking note. The European Union’s Cyber Resilience Act, set to fully apply in 2027, will require manufacturers to report actively exploited vulnerabilities and provide timely security updates. In the U.S., the FDA already mandates similar rules for medical devices, and there are growing calls to extend such requirements to consumer IoT. Dreame’s prolonged silence could accelerate those conversations, as lawmakers and industry groups point to this case as evidence that voluntary cooperation is insufficient.

What the Community Is Saying

On WindowsNews.ai and other tech forums, reaction has been sharp. “Improper certificate validation is a well-documented, easily avoided pitfall,” one user commented, “and its presence in modern applications highlights systemic weaknesses in the mobile app supply chain.” Others expressed relief that the fix finally arrived but questioned why it took so long. “Dreame’s headquarters being in China complicates transparency and coordination,” another noted, “but it doesn’t excuse a ten-month delay.”

Some users reported that they had already moved away from the Dreame ecosystem, opting for competitors that demonstrated better security practices. However, many loyal customers feel trapped by expensive hardware investments. The incident has prompted calls for an industry-wide “security nutrition label” for IoT apps, giving consumers clear information about update frequency and vulnerability disclosure policies before they buy.

Looking Forward: Vigilance Remains Key

Even with the patch, users should remain cautious. No fix is ever perfect, and the complexity of TLS implementations means that future regressions are possible. Dreame must earn back trust through transparent communication, prompt future patches, and a robust vulnerability disclosure program. The company’s move to remove unencrypted communications entirely is a step in the right direction, but it must become standard practice, not a one-time emergency fix.

For now, the most important takeaway is action: update your apps today. If you manage a network, enforce strict segmentation and monitoring. And if you’re an IoT developer, let this episode be a lesson in humility—no one is too big to fail when it comes to security basics.