CVE-2025-59452 MEDIUM

CVE-2025-59452

Vendor Yosmart

Product YoLink API

Weakness CWE-340

Published October 6, 2025

Last update November 26, 2025

View on NVD All CVEs

CVSS base score

5.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.

Key dates

02Disclosure timeline

October 6, 2025 CVE published

November 26, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-59452 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/340.html

Related vulnerabilities

04Related CVE

CVE-2025-15604 Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions CVE-2025-40926 Plack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurely CVE-2026-5081 Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure CVE-2025-40924 Catalyst::Plugin::Session before version 0.44 for Perl generates session ids insecurely CVE-2020-1905