CVE-2025-59449

The YoSmart YoLink MQTT broker and ecosystem components through 2025-10-02 contain multiple concrete issues: (1) insufficient authorization controls allow cross-account attack if an attacker learns device IDs, potentially enabling remote control of other users’ devices; (2) YoLink device IDs are ...

YoSmart YoLink MQTT broker 安全漏洞

YoSmart YoLink MQTT broker is a messaging proxy server from YoSmart USA. A security vulnerability exists in YoSmart YoLink MQTT broker version 2025-10-02 and earlier, which stems from insufficient authorization controls and could lead to cross-account attacks...

CVE-2025-59449

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacke...