PT-2025-40946 · Yosmart · Yolink Mqtt Broker

Nicholas Cerne + 1 · Published 2025-10-06 · Updated 2025-10-07 · CVE-2025-59449

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YoSmart YoLink MQTT broker versions through 2025-10-02

Description The YoLink MQTT broker does not adequately enforce authorization controls, which can lead to cross-account attacks. An attacker who obtains device IDs can remotely operate devices belonging to other users. The predictability of YoLink device IDs facilitates exploitation, potentially granting full control over other users' devices.

Recommendations Update to a version beyond 2025-10-02.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-59449

Affected Products

Yolink Mqtt Broker

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-59449 · Security Note
• https://t.me/CVEtracker/34278 · Telegram Post
• https://shop.yosmart.com/pages/sa-2025-001 · Note
• https://twitter.com/CVEnew/status/1975294172815872315 · Twitter Post
• https://bishopfox.com/blog/advisories · Note
• https://shop.yosmart.com/pages/product-support · Note
• https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home · Note
• https://twitter.com/VulmonFeeds/status/1975386192309833857 · Twitter Post