CVE-2025-29660: Input Validation

Published Apr 21, 2025

Updated

A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques.

Affected Software

3 affected components

Yi IOT XY-3820

All of the following

Yiiot Xy-3820 Firmware=6.0.24.10

Yiiot Xy-3820

Event History

Apr 21, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-29660?

CVE-2025-29660 is considered a high-severity vulnerability due to the risk of arbitrary script execution.

How do I fix CVE-2025-29660?

To fix CVE-2025-29660, update the Yi IOT XY-3820 device to the latest firmware that addresses this vulnerability.

What are the potential impacts of CVE-2025-29660?

The potential impacts of CVE-2025-29660 include unauthorized access to the device and execution of malicious scripts.

Which device is affected by CVE-2025-29660?

The affected device for CVE-2025-29660 is the Yi IOT XY-3820 running firmware version v6.0.24.10.

How does CVE-2025-29660 exploit the Yi IOT XY-3820?

CVE-2025-29660 exploits the Yi IOT XY-3820 by leveraging a poorly secured TCP service on port 6789 to execute arbitrary scripts.