Loading story…
A critical vulnerability, tracked as CVE-2025-10910, was discovered in the binding process of Govee’s cloud platform and devices, allowing remote attackers to associate any online Govee device with their own account. By exploiting weaknesses in the server-side API, attackers can use a combination of device identifiers and a client-computed value—none of which are cryptographically bound to the device itself—to gain full control over the device and remove it from the legitimate owner’s account. The flaw has been verified on the Govee H6056 lamp running firmware version 1.08.13, but other Govee cloud-connected devices may also be affected.
Govee has responded by rolling out firmware and server-side fixes, though it cannot provide a comprehensive list of affected products. Devices that have reached end-of-life for security support are not eligible for updates and require replacement with newer models that support security updates. The vulnerability was reported by researchers at NASK and coordinated by CERT Polska, highlighting the risk of remote exploitation and the need for users to ensure their devices are updated or replaced if unsupported.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Following disclosure, Govee released firmware and server-side mitigations for the device association flaw. The company could not provide a complete list of affected products, and end-of-life devices require replacement rather than patching.
CERT Polska disclosed CVE-2025-10910, a critical vulnerability affecting Govee cloud-connected devices and verified on the H6056 lamp running firmware 1.08.13. The flaw allows a remote attacker to bind an online device to their own account, take full control, and remove the legitimate owner.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researcher Sammy Azdoufal publicly disclosed a broad set of vulnerabilities in Aqara’s cloud platform, including **CVE-2026-50084**, a critical authorization flaw in the production API that allowed any valid developer token to access user-scoped endpoints for arbitrary accounts. The issue, rated **CVSS 9.6** and classified as `CWE-862`, affected `open-cn.aqara.com/v3.0/open/api` and stemmed from missing per-account authorization checks rather than the platform’s MD5-based request-signing scheme. Aqara said the flaw was fixed in April, before public disclosure, but the researcher reported mixed remediation status across the wider set of findings. The disclosure tied **ten CVEs** to Aqara cloud, mobile, and developer systems, including hardcoded OAuth credentials in the IAM/SSO gateway (**CVE-2026-50083**), an unauthenticated MQTT debug interface in Aqara Board (**CVE-2026-50085**), an unauthenticated AES oracle (**CVE-2026-50086**), permissive CORS issues (**CVE-2026-50087**, **CVE-2026-50088**), an OAuth `redirect_uri` validation bypass (**CVE-2026-50090**), and hardcoded cryptographic keys in the Aqara Home Android SDK (**CVE-2026-50091**). According to the advisory and CVE records, several of these flaws could be chained with **CVE-2026-50084** to achieve **fully unauthenticated remote takeover of affected devices**, while the GitHub disclosure also alleged additional exposures in Aqara back-office infrastructure and disputed the vendor’s claim that the impact was limited to test environments.
Jun 29, 2026
TP-Link patched a high-severity authentication bypass vulnerability in its *VIGI* surveillance camera product line that allows an attacker with **local network (LAN) access** to reset the administrator password and take full control of affected devices. Tracked as **CVE-2026-0629** (CVSS v4.0 **8.7**), the issue is in the cameras’ local web interface **password recovery** workflow, where improper reliance on **client-side state** enables password reset without verification, requiring no privileges or user interaction. Successful exploitation can enable attackers to access or manipulate live/recorded video, change configurations, disable security features, and potentially use compromised cameras as a pivot for lateral movement or botnet/DDoS activity. Reporting attributes the discovery to **Arko Dhar (Redinent Innovations)** and notes broad model impact across VIGI C and VIGI InSight lines (reported as 28 series in one account and 32+ models in another); one researcher assessment identified **2,500+ internet-exposed** potentially vulnerable devices from checks of a single model, suggesting wider exposure where cameras are reachable from the internet despite the LAN-oriented attack vector.
Jun 29, 2026
Security researchers at Bishop Fox uncovered multiple zero-day vulnerabilities in the YoLink Smart Hub (v0382), a widely used and inexpensive IoT gateway device that manages smart locks, sensors, plugs, and other home automation products. The vulnerabilities, which were disclosed publicly and assigned four separate CVEs, include a critical authorization bypass that allows remote attackers to control devices belonging to other users. This flaw, tracked as CVE-2025-59449 and CVE-2025-59452, stems from insufficient authorization controls, enabling hackers to exploit predictable device IDs and gain unauthorized access to smart home systems. Researchers demonstrated the ability to remotely operate a smart lock in a different user’s home, highlighting the real-world impact of the vulnerabilities. Another critical issue, CVE-2025-59448, involves the transmission of sensitive data, such as Wi-Fi credentials and device IDs, in cleartext over the network, making it possible for attackers to intercept and misuse this information. The YoLink Smart Hub uses the ESP32 System-on-Chip and communicates with mobile apps via the MQTT protocol, distributing commands to devices using LoRa or LoRaWAN radio technology. The research found that the hub’s session management is flawed, with long-lived tokens that allow ongoing unauthorized access once compromised. All users of the YoLink Smart Hub v0382 are at risk, as the device serves as the central point of control for all connected YoLink products. The vulnerabilities were discovered through hands-on hardware analysis and reverse engineering of the device’s firmware and communication protocols. The researchers recommend treating the YoLink hub as untrusted, disconnecting or segmenting it from critical networks, and avoiding its use for access control purposes. They also advise consumers to consider switching to vendors that provide regular security updates and independent security testing. The findings underscore the broader risks associated with deploying low-cost, poorly secured IoT devices in home environments. The disclosure of these vulnerabilities serves as a warning to both consumers and manufacturers about the importance of robust security practices in the rapidly growing smart home market. The research highlights the ease with which attackers can exploit insecure IoT devices, often available for as little as $20, to gain access to private homes. The incident demonstrates the need for improved security standards and regular patching in the IoT ecosystem. The YoLink vulnerabilities exemplify how a single compromised device can jeopardize the security of an entire smart home network. The public disclosure aims to prompt both users and manufacturers to take immediate action to mitigate these risks.
Jun 29, 2026