Yeelight vulnerabilities
3 vulnerabilities
Known vulnerabilities in Yeelight products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Smart Ai Speaker1 vulnerabilities
- Smart Lamp1 vulnerabilities
- Yeelight Classic1 vulnerabilities
CVE-2018-20007yeelightsmart_ai_speaker_firmware
EPSS score0.49%
Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.CVE-2025-8210yeelightyeelight_classic+1EPSS score0.25%
A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component com.yeelight.cherry. The manipulation leads to improper export of android application components. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2023-42189eveeve_door_and_window_firmware+8EPSS score1.02%
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function.