CVE-2025-56400

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-56400", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-05T01:18:32.857Z", "dateReserved": "2025-08-16T00:00:00.000Z", "datePublished": "2025-11-24T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T01:18:32.857Z"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://src.tuya.com/announcement/30"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-352", "lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-384", "lang": "en", "description": "CWE-384 Session Fixation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T20:12:34.225757Z", "id": "CVE-2025-56400", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T20:14:42.080Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-56400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-24T20:12:34.225757Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384 Session Fixation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T20:13:43.566Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://src.tuya.com/announcement/30"}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-05T01:18:32.857Z"}}}, "cveMetadata": {"cveId": "CVE-2025-56400", "state": "PUBLISHED", "dateUpdated": "2026-07-05T01:18:32.857Z", "dateReserved": "2025-08-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-11-24T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tuya:smartlife:6.3.1:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "0CF67072-EEB4-450F-AF95-AD156911D384", "vulnerable": true}, {"criteria": "cpe:2.3:a:tuya:smartlife:6.3.4:*:*:*:*:android:*:*", "matchCriteriaId": "04E6387D-69E1-45A0-B7D9-193FB792E119", "vulnerable": true}, {"criteria": "cpe:2.3:a:tuya:tuya:*:*:*:*:*:android:*:*", "matchCriteriaId": "61AEDA2E-C69C-45DB-899C-6A4BB5497CF3", "versionEndExcluding": "6.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tuya:tuya:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "DF11CD85-42F0-47A4-998B-A666B8DA69FE", "versionEndExcluding": "6.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tuya:tuya_smart:6.3.1:*:*:*:*:android:*:*", "matchCriteriaId": "C64E24CF-3387-4E95-9C42-84605B5CC230", "vulnerable": true}, {"criteria": "cpe:2.3:a:tuya:tuya_smart:6.3.1:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "37DD5BCF-A48D-460D-90BC-AB7D59035558", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en la implementaci\u00f3n OAuth del SDK Tuya 6.5.0 para Android e iOS, afecta a las aplicaciones m\u00f3viles Tuya Smart y Smartlife, as\u00ed como a otras aplicaciones de terceros que integran el SDK, permite a un atacante vincular su propia cuenta de Amazon Alexa a la cuenta Tuya de una v\u00edctima. Las aplicaciones no validan el par\u00e1metro de estado OAuth durante el flujo de vinculaci\u00f3n de cuentas, lo que permite un ataque similar a la Cross-Site Request Forgery (CSRF). Al enga\u00f1ar a la v\u00edctima para que haga clic en un enlace de autorizaci\u00f3n manipulado, un atacante puede completar el flujo OAuth en nombre de la v\u00edctima, lo que resulta en acceso no autorizado de Alexa a los dispositivos conectados a Tuya de la v\u00edctima. Esto afecta a los usuarios independientemente de la vinculaci\u00f3n previa con Alexa y no requiere que la aplicaci\u00f3n Tuya est\u00e9 activa en ese momento. La explotaci\u00f3n exitosa puede permitir el control remoto de dispositivos como c\u00e1maras, timbres, cerraduras de puertas o alarmas."}], "id": "CVE-2025-56400", "lastModified": "2026-11-05T13:10:00.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-56400", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T20:12:34.225757Z", "version": "2.0.3"}}]}, "published": "2025-11-24T20:15:49.560", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://src.tuya.com/announcement/30"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-384"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-12-01T15:19:21.101727+00:00", "updated": "2025-12-01T15:19:21.101753+00:00", "vendors": ["apple", "apple$PRODUCT$ios", "google", "google$PRODUCT$android", "tuya", "tuya$PRODUCT$smart", "tuya$PRODUCT$smartlife", "tuya$PRODUCT$tuya"]}