Yosmart
6 CVEs across 5 Yosmart products. Browse Yosmart vulnerabilities, severities, and proof-of-concept exploits.
Yosmart products with known CVEs
Yosmart CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-59452 | Medium | 5.8 | 2025-10-06 | The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, su… |
CVE-2025-59451 | Low | 3.5 | 2025-10-06 | The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes. |
CVE-2025-59450 | Medium | 4.3 | 2025-10-06 | The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. |
CVE-2025-59449 | Medium | 4.9 | 2025-10-06 | The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to… |
CVE-2025-59448 | Medium | 4.7 | 2025-10-06 | Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monit… |
CVE-2025-59447 | Low | 2.2 | 2025-10-06 | The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log… |