Vulnerability · Published Jun 27, 2025 · Assigned by icscert

CVE-2025-6521TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm

High 7.6

In plain English

A high-severity broken cryptography in Sight Bulb Pro Firmware ZJ_CG32-2201 from TrendMakers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)<0.1%top 99.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which may include sensitive information such as network credentials.

Affected products (as reported)

Vendor	Product	Versions
TrendMakers	Sight Bulb Pro Firmware ZJ_CG32-2201	0 – through 8.57.83

Weakness: CWE-327 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References