Loading story…
Check Point Research demonstrated that a Zigbee-connected smart lightbulb can be turned into an entry point for attacks against a broader smart home network. The researchers showed that flaws in the bulb’s wireless communication and update process could let an attacker take control of the device from a distance, spread malicious code to the home’s Zigbee bridge, and potentially pivot into other connected systems on the same network.
The report highlights how an apparently low-risk IoT device can become a practical foothold for wider compromise, especially in environments where consumer smart devices share connectivity with more sensitive assets. By using a common household lightbulb as the initial vector, the research underscored the security risks posed by weakly protected embedded devices and the need for vendors and users to apply firmware updates, segment networks, and scrutinize trust relationships between hubs, bridges, and endpoint devices.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published findings showing how smart lightbulbs could be abused as an attack vector, detailing the security risks associated with connected lighting devices.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Bishop Fox uncovered multiple zero-day vulnerabilities in the YoLink Smart Hub (v0382), a widely used and inexpensive IoT gateway device that manages smart locks, sensors, plugs, and other home automation products. The vulnerabilities, which were disclosed publicly and assigned four separate CVEs, include a critical authorization bypass that allows remote attackers to control devices belonging to other users. This flaw, tracked as CVE-2025-59449 and CVE-2025-59452, stems from insufficient authorization controls, enabling hackers to exploit predictable device IDs and gain unauthorized access to smart home systems. Researchers demonstrated the ability to remotely operate a smart lock in a different user’s home, highlighting the real-world impact of the vulnerabilities. Another critical issue, CVE-2025-59448, involves the transmission of sensitive data, such as Wi-Fi credentials and device IDs, in cleartext over the network, making it possible for attackers to intercept and misuse this information. The YoLink Smart Hub uses the ESP32 System-on-Chip and communicates with mobile apps via the MQTT protocol, distributing commands to devices using LoRa or LoRaWAN radio technology. The research found that the hub’s session management is flawed, with long-lived tokens that allow ongoing unauthorized access once compromised. All users of the YoLink Smart Hub v0382 are at risk, as the device serves as the central point of control for all connected YoLink products. The vulnerabilities were discovered through hands-on hardware analysis and reverse engineering of the device’s firmware and communication protocols. The researchers recommend treating the YoLink hub as untrusted, disconnecting or segmenting it from critical networks, and avoiding its use for access control purposes. They also advise consumers to consider switching to vendors that provide regular security updates and independent security testing. The findings underscore the broader risks associated with deploying low-cost, poorly secured IoT devices in home environments. The disclosure of these vulnerabilities serves as a warning to both consumers and manufacturers about the importance of robust security practices in the rapidly growing smart home market. The research highlights the ease with which attackers can exploit insecure IoT devices, often available for as little as $20, to gain access to private homes. The incident demonstrates the need for improved security standards and regular patching in the IoT ecosystem. The YoLink vulnerabilities exemplify how a single compromised device can jeopardize the security of an entire smart home network. The public disclosure aims to prompt both users and manufacturers to take immediate action to mitigate these risks.
Jun 29, 2026
TP-Link disclosed **CVE-2026-76784**, a high-severity vulnerability (CVSS v4.0 **8.7**) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products. An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.
Aug 27, 2026
Palo Alto Networks Unit 42 reported that attackers exploited vulnerable **home and small office wireless routers** and used the compromised devices as infrastructure to target **gaming servers**. The activity turned consumer and small-business networking equipment into a distributed attack platform, allowing malicious traffic to be routed through legitimate internet connections and making the attacks harder to trace directly to the operators. The report highlights how poorly secured edge devices can be repurposed beyond simple botnet activity and used to disrupt online gaming environments. For defenders, the incident underscores the need to patch router firmware, disable exposed remote administration features, replace default credentials, and monitor for unusual outbound traffic from SOHO networking equipment that may indicate compromise.
Jul 12, 2026