PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

YoSmart YoLink Hub version 0382

bishopfox.com | blog | #vulnerability-disclosure | #iot-security | #smart-home | #mqtt | #yolink | #authorization-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox found three flaws in the YoSmart YoLink Hub v0382: insufficient authorization controls, unencrypted MQTT traffic, and improper session management; YoLink later confirmed server-side fixes.
Published
Collected

Related coverage

blog · bishopfox.com
How a $20 Smart Device Gave Me Access to Your Home
The story behind the YoLink research: an authorization bypass lets attackers control other users' devices, Wi-Fi credentials travel in cleartext, and long-lived tokens permit persistent hub access.
blog · blog.viettelcybersecurity.com
Lỗ hổng điều khiển các thiết bị SmartHome Lumi
Researcher analyzes Lumi smart home devices, finding hardcoded MQTT credentials in firmware and weak controls that let attackers manipulate lights and locks via local Wi-Fi or the cloud.
blog · bishopfox.com
Sparkplug B Protocol Fuzzing with AI Assistance
Bishop Fox releases a Sparkplug B protocol fuzzer — the first public one covering all 9 message types, 19 data types, and 87+ field paths — built with AI assistance for ICS and SCADA deployments.
blog · bishopfox.com
Bishop Fox Wrapped: Research Worth Replaying
Bishop Fox Wrapped: the year's most-revisited research, sessions, and posts, covering social engineering, vulnerability research, mobile testing, deepfakes, IoT hacking, and LLM pen testing.
blog · bishopfox.com
Invasion of the Face Changers: Halloween Hijinks with Bluetooth LED Masks
A Bluetooth LED mask with no pairing or authentication, white-labeled across brands, can be hijacked by anyone nearby; the AES key is public on GitHub, and a CircuitPython script can push new faces.
blog · bishopfox.com
Traeger Grill D2 Wi-Fi Controller, Version 2.02.04
Bishop Fox found two vulnerabilities and two informational issues in the Traeger Grill D2 Wi-Fi Controller (2.02.04), including authorization flaws (CVSS 7.1) enabling control of others' grills.
Back