CVE-2025-59452

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-59452", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-11-26T15:21:54.400Z", "dateReserved": "2025-09-16T00:00:00.000Z", "datePublished": "2025-10-06T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "YoLink API", "vendor": "YoSmart", "versions": [{"lessThanOrEqual": "2025-10-02", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-26T15:21:54.400Z"}, "references": [{"url": "https://bishopfox.com/blog/advisories"}, {"url": "https://shop.yosmart.com/pages/product-support"}, {"url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}, {"url": "https://shop.yosmart.com/pages/sa-2025-001"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-06T20:16:45.320859Z", "id": "CVE-2025-59452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T20:16:55.103Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-06T20:16:45.320859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-06T20:16:51.880Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "YoSmart", "product": "YoLink API", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025-10-02"}], "defaultStatus": "unknown"}], "references": [{"url": "https://bishopfox.com/blog/advisories"}, {"url": "https://shop.yosmart.com/pages/product-support"}, {"url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}, {"url": "https://shop.yosmart.com/pages/sa-2025-001"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-340", "description": "CWE-340 Generation of Predictable Numbers or Identifiers"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-11-26T15:21:54.400Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59452", "state": "PUBLISHED", "dateUpdated": "2025-11-26T15:21:54.400Z", "dateReserved": "2025-09-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-10-06T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "YoLink API", "vendor": "YoSmart", "versions": [{"lessThanOrEqual": "2025-10-02", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50."}, {"lang": "es", "value": "La API de YoSmart YoLink hasta el 02-10-2025 utiliza una URL de endpoint que se deriva de la direcci\u00f3n MAC de un dispositivo junto con un hash MD5 de informaci\u00f3n no secreta, como una clave que comienza con cf50."}], "id": "CVE-2025-59452", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59452", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-06T20:16:45.320859Z", "version": "2.0.3"}}]}, "published": "2025-10-06T20:15:36.937", "references": [{"source": "cve@mitre.org", "url": "https://bishopfox.com/blog/advisories"}, {"source": "cve@mitre.org", "url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"}, {"source": "cve@mitre.org", "url": "https://shop.yosmart.com/pages/product-support"}, {"source": "cve@mitre.org", "url": "https://shop.yosmart.com/pages/sa-2025-001"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-340"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"created": "2025-10-08T13:39:09.510510+00:00", "updated": "2025-10-08T13:39:09.510544+00:00", "vendors": ["yosmart", "yosmart$PRODUCT$yolink_api"]}