Back to Database
Status published
Medium
CVE-2025-59449
The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce...
Vulnerability Description
The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59449
Credits & Attribution
No credits recorded in the NVD database.
References
More from YoSmart
View All →CVE-2025-59452
The YoSmart YoLink API through 2025-10-02 uses an endpoint URL...
Medium
5.8
CVE-2025-59451
The YoSmart YoLink application through 2025-10-02 has session tokens with...
Low
3.5
CVE-2025-59450
The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and...
Medium
4.3
CVE-2025-59448
Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted...
Medium
4.7
CVE-2025-59447
The YoSmart YoLink Smart Hub device 0382 exposes a UART...
Low
2.2
Affected Vendor
YoSmart
View all reports →Affected Software
YoLink MQTT broker
Vulnerable Versions:
0
Timeline
Official Publish:
October 6th, 2025
Last Modified:
November 26th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N