Loading story…
A security assessment of the Plugwise Anna connected thermostat uncovered multiple weaknesses in the device and its supporting infrastructure, including an exposed production UART debug interface that provided U-Boot access and enabled firmware extraction from the device’s flash. Reverse engineering of the thermostat’s customized OpenWrt firmware showed that Plugwise’s encrypted Lua application could be decrypted because the key was embedded in the interpreter, exposing source code and increasing the risk of further compromise through the web interface.
The researcher also found that the thermostat relied on reverse SSH tunnels to a Plugwise relay server and was able to retrieve a private key through the device API, leading to interactive shell access on an outdated Amazon Linux relay host. A scan of the relay server identified 205 publicly reachable reverse SSH tunnels into deployed customer devices, unnecessarily exposing home-network systems. According to the disclosure timeline, the issues were reported to Plugwise in June 2018, and the company hardened its back-end servers and relay users by October 2018.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Codean Labs publicly disclosed its findings on the Plugwise Anna thermostat, detailing device-side weaknesses and exposure created by publicly reachable reverse SSH tunnels into deployed devices. The original post was published on 2018-11-07.
By 2018-10-07, Plugwise had hardened its back-end servers and relay user configuration in response to the reported thermostat security issues. This addressed the exposed relay infrastructure described in the assessment.
A security assessment of the Plugwise Anna IoT thermostat uncovered weaknesses including exposed UART debug access, recoverable firmware and Lua code, and insecure reverse SSH tunnel design. The issues were reported to Plugwise on 2018-06-16.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two vulnerabilities in the Askey AP5100W Wi-Fi mesh node that can let attackers on the local network gain administrative access and retrieve sensitive configuration data. In `CVE-2020-25546`, the web management interface was found to use a flawed authentication design that appears to set a global authenticated state after any successful login, rather than creating a user-specific session. Because the interface reportedly uses no session keys or cookies, a second user on the network may be able to access administrative functions once a legitimate administrator has logged in. In `CVE-2020-25545`, the same device was reported to expose configuration backups containing sensitive data, including the admin password and Wi-Fi password. An authenticated attacker can generate and download the backup archive, and STAR Labs said that if a backup file already exists, it may be possible to retrieve it without authentication in a worst-case scenario. The researchers tested the issues on firmware `Dual_SIG_1.01.071` and said the product had been supplied to Singtel broadband customers, while repeated disclosure attempts to Askey, CSA, Singtel, and MITRE reportedly received limited or no vendor response.
Jun 29, 2026
TP-Link disclosed **CVE-2026-76784**, a high-severity vulnerability (CVSS v4.0 **8.7**) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products. An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.
Aug 27, 2026
GreyNoise reported that a stealthy campaign dubbed **AyySSHush** compromised more than 9,000 internet-exposed Asus routers by exploiting authentication weaknesses and `CVE-2023-39780`, then establishing persistence without deploying conventional malware. The attackers enabled SSH on TCP port `53282`, inserted their own public key for remote access, and stored the configuration in NVRAM so the backdoor survives reboots and standard firmware upgrades. Researchers said the operation was unusually quiet and targeted, with GreyNoise observing only a few dozen malicious HTTP POST requests over several months, while the attackers also disabled logging and Asus **AiProtection** to reduce the chance of detection. Asus released firmware updates to address the documented vulnerability and undocumented login bypasses, but devices already compromised require manual cleanup or a full factory reset because upgrading firmware alone does not remove the implanted SSH access. The incident echoes earlier large-scale router compromises such as **VPNFilter**, the sophisticated botnet that infected hundreds of thousands of routers and NAS devices, used modular malware, and raised fears of disruptive operations tied to Ukraine; together, the cases underscore how edge devices can be quietly converted into durable footholds for botnet activity and potential follow-on attacks.
Jun 29, 2026