Search: “Amazon Smart Plug”

ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

ZDI disclosed a Pwn2Own certificate validation flaw (CVSS 6.8) in Amazon Smart Plug's OTA process, allowing network-adjacent attackers to bypass update verification.

The Zero Day Initiative published ZDI-26-558 for an improper certificate validation flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Network-adjacent attackers need no authentication to bypass certificate validation for over-the-air updates. ZDI rated the issue CVSS 6.8.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed a Pwn2Own out-of-bounds write RCE (CVSS 7.5) in Amazon Smart Plug's OTA process, exploitable by unauthenticated network-adjacent attackers.

The Zero Day Initiative published ZDI-26-559 for an out-of-bounds write remote code execution flaw in the Amazon Smart Plug OTA update process, demonstrated at Pwn2Own. Unauthenticated network-adjacent attackers can execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.5.

ZDI Published Advisories·Aug 12, 05:00 UTC · Aug 12, 2026Advisory

Amazon introduces eero Pro 6 and eero 6, delivering Wi-Fi 6 performance

Help Net Security·Sep 28, 00:00 UTC · Sep 28, 2020Vulnerability

Is that smart device secure, and will it protect your privacy?

Help Net Security·Feb 27, 00:00 UTC · Feb 27, 2018Vulnerability

Locked Windows machines can be compromised through Cortana

Help Net Security·Mar 7, 00:00 UTC · Mar 7, 2018Malware

On the Radar: Securing Web 3.0, the Metaverse and beyond

Cisco Talos·Mar 22, 12:01 UTC · Mar 22, 2022Phishing & fraud

AWS Outposts: Fully managed and configurable racks of AWS-designed hardware

Help Net Security·Apr 20, 09:59 UTC · Apr 20, 2026Policy & legal