Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another us

Summary

Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://f-droid.org/packages/li.klass.fhem/
• Referencehttps://github.com/klassm/andFHEM
• Referencehttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107051.md