PT-2025-17441 · Yi · Yi Iot Xy-3820

Yasha-Ops · Published 2025-04-21 · Updated 2025-06-23 · CVE-2025-29660

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yi IOT XY-3820 version 6.0.24.10

Description A vulnerability exists in the daemon process of the Yi IOT XY-3820, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques.

Recommendations For version 6.0.24.10, as a temporary workaround, consider restricting access to the TCP service on port 6789 until a patch is available. Avoid using directory traversal techniques in TCP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-29660

Affected Products

Yi Iot Xy-3820

References · 13

• 🔥 https://github.com/Yasha-ops/vulnerability-research/tree/master/CVE-2025-29660 · Exploit
• https://github.com/Yasha-ops/RCE-YiIOT · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29660 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29660 · Vendor Advisory
• https://t.me/cvetracker/22054 · Telegram Post
• https://t.me/cvedetector/23439 · Telegram Post
• https://twitter.com/cybercronai/status/1914809164582223952 · Twitter Post
• https://twitter.com/cracbot/status/1915722504934461720 · Twitter Post
• https://twitter.com/cracbot/status/1916084905412354412 · Twitter Post
• https://t.me/cvenotify/126378 · Telegram Post
• https://twitter.com/dailycve/status/1937170645563191508 · Twitter Post
• https://twitter.com/CVEnew/status/1914337273526595693 · Twitter Post
• https://twitter.com/cybercronai/status/1914663100352962947 · Twitter Post