YYoSmart

Products

Exploited and recent CVEs

• CVE-2025-59452 Medium 5.8 The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50. 0.4%
• CVE-2025-59451 Low 3.5 The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. 0.3%
• CVE-2025-59448 Medium 4.7 Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain 0.2%
• CVE-2025-59449 Medium 4.9 The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the 0.3%
• CVE-2025-59447 Low 2.2 The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentia 0.2%
• CVE-2025-59450 Medium 4.3 The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. 0.1%