ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Amazon Smart Plug

0 mentions in 7 days · 0 in 30 days · 3 total · first seen · last

Search everything

Timeline

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.

The Zero Day Initiative published ZDI-26-559 for an out-of-bounds write remote code execution flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.5.

ZDI Published Advisories · Aug 12, 2026Advisory

ZDI-26-557: (Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

ZDI disclosed a Pwn2Own information disclosure flaw (CVSS 4.3) in Amazon Smart Plug, letting unauthenticated network-adjacent attackers access sensitive information.

The Zero Day Initiative published ZDI-26-557 for an insecure fallback information disclosure flaw in Amazon Smart Plug, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can disclose sensitive information on affected installations. ZDI rated the issue CVSS 4.3.

ZDI Published Advisories · Aug 12, 2026Advisory

ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.

The Zero Day Initiative published ZDI-26-558 for an improper certificate validation flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Network-adjacent attackers need no authentication to bypass certificate validation for over-the-air updates. ZDI rated the issue CVSS 6.8.

ZDI Published Advisories · Aug 12, 2026Advisory

Appears with

organization Zero Day Initiative 3vendor Amazon 3vendor Zero Day Initiative 3
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.