CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised...

7.5 High

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.90%Up 1.1 points since Mar 8, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2020-36517
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-36517
Updated: 2026-11-02

EUVDEUVD-2020-23995 No score

Record: EUVD-2020-23995
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wj7x-544h-j3j3 7.5

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised...

Record: GHSA-wj7x-544h-j3j3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

OSV 7.5

Record: CVE-2020-36517
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

home-assistant

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36517 is a high vulnerability (CVSS 7.5) in Home-assistant, published March 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.90%, the 87th percentile. No source names a fixed version.

References

Show 11 moreShow less