YoSmart YoLink Ecosystem up to 2025-10-02 MQTT cleartext transmission

Summaryinfo

A vulnerability has been found in YoSmart YoLink Ecosystem up to 2025-10-02 and classified as problematic. The impacted element is an unknown function of the component MQTT Handler. The manipulation leads to cleartext transmission. This vulnerability is listed as CVE-2025-59448. The attack must be carried out from within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in YoSmart YoLink Ecosystem up to 2025-10-02. This issue affects an unknown part of the component MQTT Handler. The manipulation with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. The summary by CVE is:

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker. NOTE: The vendor states that the vulnerability described (related to insecure transmission) only impacts the legacy mobile application logic, not the Hub hardware or firmware. The Hub functions solely as a pass-through (transparent gateway) for LoRa wireless data and does not inspect or process the application layer data.

It is possible to read the advisory at bishopfox.com. The identification of this vulnerability is CVE-2025-59448 since 09/16/2025. The exploitation is known to be difficult. The attack needs to be done within the local network. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1040 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• YoSmart

Name

• YoLink Ecosystem

Version

• 2025-10-02

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion