$20 YOLINK IOT GATEWAY VULNERABILITIES PUT HOME SECURITY AT RISK

Summary from the TLDR InfoSec newsletter

Bishop Fox researchers discovered four critical zero-day vulnerabilities in the $20 YoLink Smart Hub v0382 that allow remote attackers to bypass authentication, intercept unencrypted credentials and Wi-Fi passwords via MQTT, and remotely control other users' devices, including smart locks, through predictable device IDs. The vulnerabilities (CVE-2025-59449, CVE-2025-59448, CVE-2025-59451, and CVE-2025-59452) affect the ESP32-based hub, which serves as a central gateway for home security devices, potentially enabling physical access to users' homes, as no patches are currently available from the manufacturer, YoSmart. Security professionals should immediately disconnect affected hubs from critical networks, avoid using them for physical access control, implement network segmentation to isolate IoT devices, and consider replacing them with vendors that provide regular security updates until patches become available.