ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
ZDI Published Advisoriespublished ()ingested

ZDI-26-557: (Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

lowAdvisoryimportance 18
AI summary · glm-5.3-flash

ZDI disclosed a Pwn2Own information disclosure flaw (CVSS 4.3) in Amazon Smart Plug, letting unauthenticated network-adjacent attackers access sensitive information.

The Zero Day Initiative published ZDI-26-557 for an insecure fallback information disclosure flaw in Amazon Smart Plug, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can disclose sensitive information on affected installations. ZDI rated the issue CVSS 4.3.

  • Unauthenticated network-adjacent attackers can disclose sensitive information from the device.
  • ZDI assigned CVSS 4.3; bug found at Pwn2Own.
Read the original
VendorsAmazonZero Day Initiative
ProductsAmazon Smart Plug
OrganizationsZero Day Initiative
Tagszdipwn2ownamazonsmart plugiotinformation disclosure
Full article

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.3.

This source does not provide full text. Read it at zerodayinitiative.com.