PT-2025-40945 · Yosmart · Yolink Hub+2

Nicholas Cerne · Published 2025-10-06 · Updated 2025-10-07 · CVE-2025-59448

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YoSmart YoLink ecosystem through 2025-10-02 YoLink Hub 0382 YoLink Mobile Application version 1.40.41 YoLink MQTT Broker

Description Components of the YoSmart YoLink ecosystem utilize unencrypted MQTT for internet communication. This allows an attacker monitoring network traffic to potentially obtain sensitive information or manipulate traffic to control devices. MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol often used in IoT devices.

Recommendations Update YoLink Hub to a version after 2025-10-02. Update YoLink Mobile Application to a version after 2025-10-02. Update YoLink MQTT Broker to a version after 2025-10-02.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-59448

Affected Products

Yolink Hub

Yolink Mqtt Broker

Yolink Mobile Application

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59448 · Security Note
• https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home · Note
• https://shop.yosmart.com/pages/product-support · Note
• https://bishopfox.com/blog/advisories · Note
• https://twitter.com/VulmonFeeds/status/1975381073560305772 · Twitter Post
• https://twitter.com/CVEnew/status/1975294171746283777 · Twitter Post
• https://t.me/CVEtracker/34277 · Telegram Post