CVE-2025-29660
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary scripts on Yi IOT XY-3820 devices by sending specially crafted TCP requests to port 6789 using directory traversal techniques. It affects all users of Yi IOT XY-3820 v6.0.24.10 devices with the vulnerable daemon running.
💻 Affected Systems
- Yi IOT XY-3820
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, steal sensitive data, pivot to internal networks, or use the device in botnets.
Likely Case
Remote code execution leading to device takeover, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact if network segmentation and strict firewall rules prevent access to port 6789.
🎯 Exploit Status
Public exploit code is available on GitHub. Attack requires only network access to port 6789.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates. If update exists: 1. Download latest firmware from vendor 2. Upload to device via admin interface 3. Apply update 4. Reboot device
🔧 Temporary Workarounds
Block Port 6789
linuxPrevent external and internal access to the vulnerable service
iptables -A INPUT -p tcp --dport 6789 -j DROP
iptables -A OUTPUT -p tcp --dport 6789 -j DROP
Disable Vulnerable Service
linuxStop the daemon process if not required
kill $(pidof vulnerable_daemon)
systemctl stop vulnerable_service
🧯 If You Can't Patch
- Segment network to isolate vulnerable devices from critical systems
- Implement strict firewall rules blocking all traffic to port 6789 except from management systems
🔍 How to Verify
Check if Vulnerable:
Check if device responds to TCP connections on port 6789: nc -zv [device_ip] 6789Check Version:
Check firmware version in device web interface or via SSH: cat /etc/versionVerify Fix Applied:
Verify port 6789 is no longer accessible and daemon is not running: netstat -tlnp | grep 6789📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from daemon
- Directory traversal patterns in daemon logs
- Failed script execution attempts
Network Indicators:
- TCP connections to port 6789 with unusual payloads
- Multiple connection attempts to port 6789 from single source
SIEM Query:
destination_port=6789 AND (payload_contains="../" OR payload_contains=".sh" OR payload_contains=".py")