Loading story…
Security researchers at Bishop Fox uncovered multiple zero-day vulnerabilities in the YoLink Smart Hub (v0382), a widely used and inexpensive IoT gateway device that manages smart locks, sensors, plugs, and other home automation products. The vulnerabilities, which were disclosed publicly and assigned four separate CVEs, include a critical authorization bypass that allows remote attackers to control devices belonging to other users. This flaw, tracked as CVE-2025-59449 and CVE-2025-59452, stems from insufficient authorization controls, enabling hackers to exploit predictable device IDs and gain unauthorized access to smart home systems. Researchers demonstrated the ability to remotely operate a smart lock in a different user’s home, highlighting the real-world impact of the vulnerabilities. Another critical issue, CVE-2025-59448, involves the transmission of sensitive data, such as Wi-Fi credentials and device IDs, in cleartext over the network, making it possible for attackers to intercept and misuse this information. The YoLink Smart Hub uses the ESP32 System-on-Chip and communicates with mobile apps via the MQTT protocol, distributing commands to devices using LoRa or LoRaWAN radio technology. The research found that the hub’s session management is flawed, with long-lived tokens that allow ongoing unauthorized access once compromised. All users of the YoLink Smart Hub v0382 are at risk, as the device serves as the central point of control for all connected YoLink products. The vulnerabilities were discovered through hands-on hardware analysis and reverse engineering of the device’s firmware and communication protocols. The researchers recommend treating the YoLink hub as untrusted, disconnecting or segmenting it from critical networks, and avoiding its use for access control purposes. They also advise consumers to consider switching to vendors that provide regular security updates and independent security testing. The findings underscore the broader risks associated with deploying low-cost, poorly secured IoT devices in home environments. The disclosure of these vulnerabilities serves as a warning to both consumers and manufacturers about the importance of robust security practices in the rapidly growing smart home market. The research highlights the ease with which attackers can exploit insecure IoT devices, often available for as little as $20, to gain access to private homes. The incident demonstrates the need for improved security standards and regular patching in the IoT ecosystem. The YoLink vulnerabilities exemplify how a single compromised device can jeopardize the security of an entire smart home network. The public disclosure aims to prompt both users and manufacturers to take immediate action to mitigate these risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Bishop Fox published research describing multiple security flaws in the low-cost YoLink Hub smart-home gateway, including issues that could allow unauthorized access to connected home devices and security functions. A contemporaneous report highlighted the same disclosure and its potential impact on home security users.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has released security updates to address four critical vulnerabilities affecting its Omada gateway devices, with two of these flaws enabling remote code execution. The most severe of these vulnerabilities, CVE-2025-6542, carries a CVSS score of 9.3 and allows remote unauthenticated attackers to execute arbitrary commands on the device's underlying operating system. Another critical flaw, CVE-2025-6541, is an operating system command injection vulnerability that can be exploited by attackers with access to the web management interface. CVE-2025-7850, also with a CVSS score of 9.3, requires possession of an administrator password to exploit, but similarly allows arbitrary command execution. The fourth vulnerability, CVE-2025-7851, involves improper privilege management and could enable attackers to obtain a root shell under certain conditions. Affected models include ER8411, ER7412-M2, ER707-M2, ER7206, ER605, ER706W, ER706W-4G, ER7212PC, G36, G611, FR365, FR205, and FR307-M2, with specific firmware versions listed as vulnerable. TP-Link has advised all users of impacted devices to immediately update to the latest firmware versions to mitigate these risks. The company also recommends verifying device configurations after upgrading the firmware to ensure security settings remain intact. There is currently no evidence that these vulnerabilities have been exploited in the wild, but the critical nature of the flaws and the potential for remote, unauthenticated exploitation make prompt patching essential. The vulnerabilities could allow attackers to gain full control over affected devices, potentially enabling lateral movement within networks or use of the devices as a foothold for further attacks. The flaws were disclosed in a coordinated manner, and TP-Link responded by releasing patches and advisories to inform customers. Security researchers have highlighted the risk posed by these vulnerabilities, especially in environments where Omada gateways are used to manage network traffic and security. Organizations using these devices should prioritize patching and review their network segmentation to limit potential exposure. The vulnerabilities underscore the importance of regular firmware updates and strong administrative credential management for network infrastructure devices. TP-Link's advisory provides detailed instructions for identifying affected models and applying the necessary updates. The disclosure has prompted renewed attention to the security of network gateways and the need for ongoing vigilance in monitoring for new vulnerabilities. Security teams are urged to monitor for signs of compromise and to ensure that all network devices are included in vulnerability management programs. The incident serves as a reminder of the critical role that timely patching plays in defending against remote exploitation threats.
Jul 12, 2026
Check Point Research demonstrated that a **Zigbee-connected smart lightbulb** can be turned into an entry point for attacks against a broader smart home network. The researchers showed that flaws in the bulb’s wireless communication and update process could let an attacker take control of the device from a distance, spread malicious code to the home’s Zigbee bridge, and potentially pivot into other connected systems on the same network. The report highlights how an apparently low-risk **IoT device** can become a practical foothold for wider compromise, especially in environments where consumer smart devices share connectivity with more sensitive assets. By using a common household lightbulb as the initial vector, the research underscored the security risks posed by weakly protected embedded devices and the need for vendors and users to apply firmware updates, segment networks, and scrutinize trust relationships between hubs, bridges, and endpoint devices.
Jul 12, 2026
TP-Link disclosed **CVE-2026-76784**, a high-severity vulnerability (CVSS v4.0 **8.7**) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products. An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.
Aug 27, 2026