PT-2025-17668 · Byd · Byd Qin Plus Dm-I Dilink Os

Rainymode · Published 2025-04-23 · Updated 2025-04-28 · CVE-2025-28169

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BYD QIN PLUS DM-i Dilink OS versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0

Description The issue allows attackers to execute a man-in-the-middle attack because the affected software sends broadcasts to the manufacturer's cloud server unencrypted.

Recommendations For versions v3.0 13.1.7.2204050.1 through v3.0 13.1.7.2312290.1 0, consider implementing encryption for broadcasts to the cloud server as a mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-28169

Affected Products

Byd Qin Plus Dm-I Dilink Os

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-28169 · Security Note
• https://twitter.com/VulmonFeeds/status/1915145987405852834 · Twitter Post
• https://t.me/cvetracker/22233 · Telegram Post
• https://twitter.com/cracbot/status/1916809702983282951 · Twitter Post
• https://t.me/cvedetector/23622 · Telegram Post
• https://gist.github.com/rainymode/bfd976ecbe0d0b776fd930375156c19c · Note
• https://byd.com · Note
• https://twitter.com/CVEnew/status/1915127781312102668 · Twitter Post
• https://twitter.com/cybercronai/status/1915579194064413047 · Twitter Post