CVE-2025-29660

9.8 criticalEPSS 1.3%

Critical (9.8) in yiiot xy-3820 firmware. EPSS 1.3% chance of exploitation in the next 30 days.

A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-04-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

yiiot:xy-3820_firmware

References

https://github.com/Yasha-ops/RCE-YiIOT
https://github.com/Yasha-ops/vulnerability-research/tree/master/CVE-2025-29660

Check your stack JSON