CVE-2025-56558 in App
Summary
by MITRE • 10/29/2025
The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/13/2026
The vulnerability described in CVE-2025-56558 represents a significant security flaw in Dyson's MQTT server implementation that emerged in 2022 and potentially persists in newer versions. This issue stems from improper access control mechanisms within the device management system, where authentication credentials alone are insufficient to prevent unauthorized access to removed devices. The vulnerability specifically affects Dyson devices such as the Pure Hot+Cool series and exploits a fundamental weakness in the device lifecycle management process. When a device is removed from a user's account and no longer appears in the MyDyson application, the system continues to accept MQTT connections using valid AWS credentials, creating a persistent access vector for malicious actors.
The technical implementation flaw resides in the authentication and authorization logic of Dyson's cloud infrastructure, where the system fails to properly validate device state during MQTT communication. This allows attackers to bypass normal device visibility checks and maintain access to devices that should no longer be accessible through standard user interfaces. The vulnerability operates through a combination of credential theft and device ownership transfer, where an attacker who has obtained AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and the device serial number can maintain control over a device even after its removal from the legitimate user's account. This represents a classic case of insufficient access control validation, which aligns with CWE-284 Access Control Issues and falls under the MITRE ATT&CK framework's privilege escalation techniques.
The operational impact of this vulnerability extends beyond simple unauthorized access to device configuration capabilities. While the attacker cannot execute code or directly access sensitive data, they can manipulate the device's operational parameters within safe limits, specifically controlling room temperature settings up to 37 degrees Celsius. This creates potential safety and security concerns, particularly in environments where precise temperature control is critical. The attack requires multiple conditions to be met including possession of a legitimate device with full privileges, successful network packet sniffing to obtain AWS credentials, and successful device ownership transfer to the target victim. However, the combination of these factors creates a real security risk that could be exploited in targeted attacks against Dyson device owners.
Security mitigation strategies should focus on strengthening the device lifecycle management process and implementing more robust access control validation. Organizations should consider implementing device state validation during MQTT authentication, ensuring that removed devices cannot be accessed even with valid credentials. Additionally, regular credential rotation and network monitoring for suspicious MQTT traffic patterns can help detect potential exploitation attempts. The vulnerability highlights the importance of proper device retirement procedures and demonstrates how cloud-based device management systems must maintain strict access control even for devices that are no longer actively managed by legitimate users. This issue underscores the need for comprehensive security testing of IoT device management systems and proper implementation of the principle of least privilege in cloud-connected consumer electronics.