CVE-2025-29660 is a critical directory traversal vulnerability affecting the daemon process of Yi IOT XY-3820 v6.0.24.10 firmware. Attackers can exploit a TCP service on port 6789, which lacks input validation, to execute arbitrary scripts on the device by sending specially crafted requests. With a CVSS score of 9.8 (Critical), this vulnerability allows for complete compromise of confidentiality, integrity, and availability. Currently, there is no public exploit code available, and it is not listed on the CISA KEV catalog, indicating no active exploitation observed. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.0.24.10CPE matchmatch criteria | cpe:2.3:o:yiiot:xy-3820_firmware:6.0.24.10:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.