EUVD-2025-177861

Malicious code in meteor-dysonswarm-geckodriver-grus npm...

MAL-2025-190083 Malicious code in upgrade-dysonswarm-node-config-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cfb3957e784c8f64be9d84de653a91b11d80d6ffbf26fbc120b8b24133d2a07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

EUVD-2025-36692

An issue discovered in Dyson App v6.1.23041-23595 allows unauthenticated attackers to control other users' Dyson IoT devices remotely via MQTT...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The provided sources describe a Dyson MQTT server vulnerability (CVE-2025-56558) affecting Dyson IoT devices dating to 2022+. A client possessing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and a device serial can publish/subscribe to Dyson MQTT topics even if the physical device...

Dyson App 安全漏洞

Dyson App is a mobile application for remote control of smart devices from Dyson Singapore. A security vulnerability exists in Dyson App versions v6.1.23041 through 23595, which originates from an unauthenticated attacker being able to remotely control another user's Dyson IoT device via MQTT...

PT-2025-44327

Name of the Vulnerable Software and Affected Versions Dyson App versions 6.1.23041-23595 Description An issue allows unauthenticated attackers to remotely control other users' Dyson IoT devices via MQTT. Recommendations At the moment, there is no information about a newer version that contains a...

Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

MAL-2025-22513 Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

Malicious code in dyson-careers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45354e686a81be1f7beae30cfe56f02066a59381c71e9bde6018e12f960b1b89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2638 Malicious code in dyson-careers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45354e686a81be1f7beae30cfe56f02066a59381c71e9bde6018e12f960b1b89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dyson Link - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Dyson Link published at the 'play' market has multiple vulnerabilities...

courts.com.sg XSS vulnerability

Vulnerable URL: http://www.courts.com.sg/searchresult.html?searchText=dyson%27-confirmOPENBUGBOUNTY-%27' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 91331 VIP website status:| N...