CVE-2025-59447

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-59447", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-10-06T20:10:34.726Z", "dateReserved": "2025-09-16T00:00:00.000Z", "datePublished": "2025-10-06T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "YoLink Smart Hub", "vendor": "YoSmart", "versions": [{"status": "affected", "version": "0382", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-06T19:53:20.201Z"}, "references": [{"url": "https://bishopfox.com/blog/advisories"}, {"url": "https://shop.yosmart.com/pages/product-support"}, {"url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.2, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T20:10:20.449420Z", "id": "CVE-2025-59447", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T20:10:34.726Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T20:10:20.449420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T20:10:22.466Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.2, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "YoSmart", "product": "YoLink Smart Hub", "versions": [{"status": "affected", "version": "0382", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://bishopfox.com/blog/advisories"}, {"url": "https://shop.yosmart.com/pages/product-support"}, {"url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-06T19:53:20.201Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59447", "state": "PUBLISHED", "dateUpdated": "2025-10-06T20:10:34.726Z", "dateReserved": "2025-09-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-10-06T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "YoLink Smart Hub", "vendor": "YoSmart", "versions": [{"status": "affected", "version": "0382", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials."}, {"lang": "es", "value": "El dispositivo YoSmart YoLink Smart Hub 0382 expone una interfaz de depuraci\u00f3n UART. Un atacante con acceso f\u00edsico directo puede aprovechar esta interfaz para leer un registro de arranque, que incluye credenciales de acceso a la red."}], "id": "CVE-2025-59447", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59447", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T20:10:20.449420Z", "version": "2.0.3"}}]}, "published": "2025-10-06T20:15:36.030", "references": [{"source": "cve@mitre.org", "url": "https://bishopfox.com/blog/advisories"}, {"source": "cve@mitre.org", "url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}, {"source": "cve@mitre.org", "url": "https://shop.yosmart.com/pages/product-support"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:39:36.682469+00:00", "updated": "2025-10-08T13:39:36.682516+00:00", "vendors": ["yosmart", "yosmart$PRODUCT$yolink_smart_hub"]}