CVE-2025-59450: YoLink Smart Hub Information Disclosure

CVE-2025-59450 Overview

CVE-2025-59450 affects the YoSmart YoLink Smart Hub running firmware version 0382. The firmware image is stored unencrypted on the device, allowing an attacker with physical access to extract sensitive data. Extracted contents include network access credentials that can be reused to compromise the connected Wi-Fi network. The issue is categorized under [CWE-312: Cleartext Storage of Sensitive Information]. Bishop Fox published research documenting the flaw and the risk it poses to consumer home networks.

Critical Impact
An attacker with physical possession of a YoLink Smart Hub can recover the unencrypted firmware and extract Wi-Fi credentials, granting unauthorized access to the victim's home or office network.

Affected Products

YoSmart YoLink Smart Hub
YoLink Smart Hub firmware version 0382
Deployments using the affected hub for smart home connectivity

Discovery Timeline

2025-10-06 - CVE-2025-59450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59450

Vulnerability Analysis

The YoLink Smart Hub stores its firmware image without encryption. An attacker who obtains a device, whether purchased, discarded, or briefly borrowed, can desolder or read the flash memory using standard hardware tools. The extracted image contains configuration data and Wi-Fi credentials in a recoverable format. Because the hub connects to the owner's local network, these credentials grant an attacker persistent access to the victim's Wi-Fi.

Bishop Fox described the practical impact in its advisory, noting that a low-cost consumer device can effectively hand over network access credentials to anyone with brief physical control of the hardware. The vulnerability requires local access but no authentication or user interaction on the target network.

Root Cause

The root cause is the absence of firmware encryption on the device's non-volatile storage. Sensitive material, including Wi-Fi credentials provisioned by the owner, is written to flash in cleartext. Neither transport nor at-rest protections shield the data from an attacker with hardware-level access to the chip.

Attack Vector

Exploitation requires physical access to the hub. An attacker removes the flash chip or uses a debug interface to dump the firmware image. Static analysis of the dump exposes stored configuration files containing SSID and passphrase data. The attacker then connects to the target Wi-Fi network from within radio range, bypassing perimeter controls. See the Bishop Fox blog on smart devices for a detailed walkthrough of the extraction process.

Detection Methods for CVE-2025-59450

Indicators of Compromise

Unauthorized devices associated with the Wi-Fi network hosting the YoLink Smart Hub
Unexpected outbound connections from the local network to unfamiliar destinations
Missing or tampered YoLink Smart Hub hardware in physical inventories

Detection Strategies

Review wireless controller and access point logs for new client MAC addresses joining after any period the hub was out of the owner's control
Correlate DHCP lease activity with authorized device inventories to spot rogue endpoints
Monitor for anomalous internal-to-internal traffic that may indicate an attacker pivoting from the compromised Wi-Fi segment

Monitoring Recommendations

Enable Wi-Fi client fingerprinting on the access point or router to detect unrecognized hardware
Alert on repeated authentication attempts using known SSID credentials from new locations or signal strengths
Track hub firmware versions through the YoLink mobile application and note any deviation from vendor-recommended releases

How to Mitigate CVE-2025-59450

Immediate Actions Required

Isolate the YoLink Smart Hub on a dedicated Internet of Things (IoT) virtual local area network (VLAN) with no access to sensitive resources
Rotate the Wi-Fi passphrase for any network that has hosted a YoLink Smart Hub if the device may have been physically accessed
Physically secure the hub to prevent unauthorized removal or handling
Consult the YoSmart product support page for vendor guidance and firmware updates

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2025-59450 at the time of publication. Firmware encryption is a hardware-and-firmware level change, so owners should monitor YoSmart advisories for updated firmware releases and apply them through the YoLink application when available. Refer to the Bishop Fox security advisories for research updates on the affected product line.

Workarounds

Deploy the hub on a segmented Wi-Fi network that contains only IoT devices and blocks lateral movement to workstations and servers
Use a strong, unique Wi-Fi passphrase for the IoT segment that is not shared with any other network
Retire or securely destroy the hub before disposal, resale, or return, since flash contents remain recoverable
Restrict physical access to the hub through placement, enclosures, or tamper-evident seals

bash

# Configuration example: segment the IoT SSID from the primary network
# (illustrative router CLI syntax, adapt to your platform)
vlan 20 name IOT
interface wlan0.iot
  ssid "HomeIoT"
  vlan 20
  wpa2-psk "<strong-unique-passphrase>"
firewall rule deny from vlan 20 to vlan 10
firewall rule allow from vlan 20 to internet