PT-2025-17440 · Yi · Yi Iot Xy-3820
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Yi IOT XY-3820 version 6.0.24.10
Description
The issue concerns Remote Command Execution via the
cmd listen function located in the cmd binary.Recommendations
For Yi IOT XY-3820 version 6.0.24.10, as a temporary workaround, consider disabling the
cmd listen function until a patch is available. Restrict access to the cmd binary to minimize the risk of exploitation.Exploit
Fix
RCE
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Yi Iot Xy-3820