EUVD-2025-177861

Malicious code in meteor-dysonswarm-geckodriver-grus npm...

MAL-2025-190083 Malicious code in upgrade-dysonswarm-node-config-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cfb3957e784c8f64be9d84de653a91b11d80d6ffbf26fbc120b8b24133d2a07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

EUVD-2025-36692

An issue discovered in Dyson App v6.1.23041-23595 allows unauthenticated attackers to control other users' Dyson IoT devices remotely via MQTT...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The Dyson MQTT server 2022 and possibly later allows publications and subscriptions by a client that has the correct values of AWSACCESSKEYID, AWSSECRETACCESSKEY, AWSSESSIONTOKEN, and device serial number, even if a device such as a Pure Hot+Cool device has been removed and is not visible in the...

CVE-2025-56558

The provided sources describe a Dyson MQTT server vulnerability (CVE-2025-56558) affecting Dyson IoT devices dating to 2022+. A client possessing AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and a device serial can publish/subscribe to Dyson MQTT topics even if the physical device...

PT-2025-44327

Name of the Vulnerable Software and Affected Versions Dyson App versions 6.1.23041-23595 Description An issue allows unauthenticated attackers to remotely control other users' Dyson IoT devices via MQTT. Recommendations At the moment, there is no information about a newer version that contains a...

Dyson App 安全漏洞

Dyson App is a mobile application for remote control of smart devices from Dyson Singapore. A security vulnerability exists in Dyson App versions v6.1.23041 through 23595, which originates from an unauthenticated attacker being able to remotely control another user's Dyson IoT device via MQTT...

Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

MAL-2025-22513 Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

Malicious code in dyson-careers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45354e686a81be1f7beae30cfe56f02066a59381c71e9bde6018e12f960b1b89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2638 Malicious code in dyson-careers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45354e686a81be1f7beae30cfe56f02066a59381c71e9bde6018e12f960b1b89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dyson Link - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Dyson Link published at the 'play' market has multiple vulnerabilities...

courts.com.sg XSS vulnerability

Vulnerable URL: http://www.courts.com.sg/searchresult.html?searchText=dyson%27-confirmOPENBUGBOUNTY-%27' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 91331 VIP website status:| N...