CVE-2022-43704

The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol udp/1024 commands interfacing directly with the target device. This, in turn, allows for...

CVE-2022-43704

creationtimestamp| type| source ---|---|--- 2023-01-20 20:22:57+00:00| seen| https://t.me/cibsecurity/56779 2026-07-29 12:00:24+00:00| seen| https://t.me/CVEhub/14825 2026-07-30 00:00:45+00:00| seen| https://t.me/CVEhub/14825 2026-07-31 00:00:29+00:00| published-proof-of-concept|...

CVE-2022-43704

CVE-2022-43704 affects Sinilink XY-WFT1 WiFi Remote Thermostat (firmware 1.3.6). The issue allows an attacker to bypass the requirement to use MQTT and replay SINILINK521 protocol commands over UDP/1024, interfacing directly with the device to control the onboard relay without mobile-app authenti...