Skip to main content

Generation of Predictable Numbers or Identifiers

CVE-2025-59452

Medium
5.8/10

Summary

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-340 - Generation of Predictable Numbers or Identifiers

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

References

Advisory Timeline

  • Published