CVE-2025-59449

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://bishopfox.com/blog/advisories
https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home
https://shop.yosmart.com/pages/product-support
https://shop.yosmart.com/pages/sa-2025-001

Configurations

No configuration.

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) El broker MQTT de YoSmart YoLink hasta el 2025-10-02 no aplica controles de autorización suficientes para prevenir ataques entre cuentas, permitiendo a un atacante operar remotamente los dispositivos afectados si el atacante obtiene los ID de dispositivo asociados. Debido a que los ID de dispositivo de YoLink son predecibles, un atacante puede explotar esto para obtener control total sobre los dispositivos de cualquier otro usuario de YoLink.

Information

Published : 2025-10-06 20:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-59449

Mitre link : CVE-2025-59449

CVE.ORG link : CVE-2025-59449

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-59449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59449", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T20:11:42.558689Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "YoSmart", "product": "YoLink MQTT broker", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025-10-02"}], "defaultStatus": "unknown"}]}], "published": "2025-10-06T20:15:36.403", "references": [{"url": "https://bishopfox.com/blog/advisories", "source": "cve@mitre.org"}, {"url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home", "source": "cve@mitre.org"}, {"url": "https://shop.yosmart.com/pages/product-support", "source": "cve@mitre.org"}, {"url": "https://shop.yosmart.com/pages/sa-2025-001", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices."}, {"lang": "es", "value": "El broker MQTT de YoSmart YoLink hasta el 2025-10-02 no aplica controles de autorizaci\u00f3n suficientes para prevenir ataques entre cuentas, permitiendo a un atacante operar remotamente los dispositivos afectados si el atacante obtiene los ID de dispositivo asociados. Debido a que los ID de dispositivo de YoLink son predecibles, un atacante puede explotar esto para obtener control total sobre los dispositivos de cualquier otro usuario de YoLink."}], "lastModified": "2026-10-09T10:10:00.193", "sourceIdentifier": "cve@mitre.org"}