PT-2025-40946

Name of the Vulnerable Software and Affected Versions YoSmart YoLink MQTT broker versions through 2025-10-02 Description The YoLink MQTT broker does not adequately enforce authorization controls, which can lead to cross-account attacks. An attacker who obtains device IDs can remotely operate...

CVE-2025-59449

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacke...

CVE-2025-59447

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...

CVE-2025-59451

The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes...

YoSmart YoLink Application 安全漏洞

YoSmart YoLink Application is a smart home management application from YoSmart USA. A security vulnerability exists in YoSmart YoLink Application version 2025-10-02 and earlier, which stems from a session token lifecycle that is too long...

CVE-2025-59449

The YoSmart YoLink MQTT broker and ecosystem components through 2025-10-02 contain multiple concrete issues: (1) insufficient authorization controls allow cross-account attack if an attacker learns device IDs, potentially enabling remote control of other users’ devices; (2) YoLink device IDs are ...

PT-2025-40945

Name of the Vulnerable Software and Affected Versions YoSmart YoLink ecosystem through 2025-10-02 YoLink Hub 0382 YoLink Mobile Application version 1.40.41 YoLink MQTT Broker Description Components of the YoSmart YoLink ecosystem utilize unencrypted MQTT for internet communication. This allows an...

CVE-2025-59448

CVE-2025-59448 concerns the YoSmart YoLink ecosystem, where components including the YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker communicate over the internet using unencrypted MQTT. The vulnerability arises from insecure transmission, allowing an attacker who can m...

CVE-2025-59451

The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes...

CVE-2025-59450

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials...

PT-2025-40948

Name of the Vulnerable Software and Affected Versions YoSmart YoLink application versions through 2025-10-02 Description The YoSmart YoLink application has session tokens with unexpectedly long lifetimes. Recommendations Update to a version later than 2025-10-02. At the moment, there is no...

CVE-2025-59452

The CVE-2025-59452 entry maps to YoSmart YoLink ecosystem vulnerabilities noted by multiple sources. The YoSmart YoLink MQTT broker (through 2025-10-02) does not enforce sufficient authorization, enabling a cross‑account attack where an attacker with device IDs could remotely operate other users’...

YoSmart YoLink API 安全漏洞

The YoSmart YoLink API is a smart home management interface from YoSmart USA. A security vulnerability exists in the YoSmart YoLink API that stems from the use of endpoint URLs based on device MAC addresses and MD5 hashes, which could lead to information disclosure...

YoSmart YoLink Smart Hub 安全漏洞

The YoSmart YoLink Smart Hub is a smart home hub device from YoSmart USA. A security vulnerability exists in the YoSmart YoLink Smart Hub version 0382, which stems from exposing the UART debugging interface and could lead to the disclosure of network access credentials...

YoSmart YoLink Ecosystem 安全漏洞

YoSmart YoLink Ecosystem is a smart home system from YoSmart USA. A security vulnerability exists in the YoSmart YoLink Ecosystem that stems from the use of unencrypted MQTT for communication, which could lead to the disclosure of sensitive information or device control...

CVE-2025-59448

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLin...

CVE-2025-59450

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials...

YoSmart YoLink MQTT broker 安全漏洞

YoSmart YoLink MQTT broker is a messaging proxy server from YoSmart USA. A security vulnerability exists in YoSmart YoLink MQTT broker version 2025-10-02 and earlier, which stems from insufficient authorization controls and could lead to cross-account attacks...

PT-2025-40947

Name of the Vulnerable Software and Affected Versions YoSmart YoLink Smart Hub firmware version 0382 Description The YoSmart YoLink Smart Hub firmware version 0382 is unencrypted. Data extracted from the device can be used to determine network access credentials. Recommendations At the moment,...

PT-2025-40949

Name of the Vulnerable Software and Affected Versions YoSmart YoLink versions through 2025-10-02 Description The YoSmart YoLink API constructs an endpoint URL using a device's MAC address and an MD5 hash of non-secret information, including a key starting with cf50. The API endpoint is derived fr...