YoSmart YoLink Smart Hub

An attacker could intercept and hijack user accounts to remotely control connected smart home devices, access sensitive user data, and potentially manipulate building automation or home energy management systems under an organization's control.

Organizations using YoSmart YoLink Smart Hub for building automation or home energy management, particularly those managing multiple user accounts or integrating IoT devices into facility control systems. Affects any facility relying on smart home devices for security, HVAC, lighting, or energy management where account hijacking could impact operations.

An attacker on the network can send requests to the YoSmart server without authentication to exploit authorization flaws, intercept unencrypted traffic to steal session tokens or credentials, or enumerate and control smart home devices registered to other users' accounts.