Live › vulnerability › CVE-2026-78845
Go to dashboardSeveral Aidot Matter smart plugs and Wi-Fi/Matter light bulbs parse UPnP root descriptions unsafely. A network attacker who can send a crafted UPnP response to the device can run code on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:32 UTC. All times on this page are UTC.
Owners of the listed Aidot-branded Linkind, OREiN and Linkind Wi-Fi devices at or below the versions above. The sources do not say whether exposure requires being on the same local network as the device, so treat any device on a shared or guest network as potentially exposed. unknown whether other Aidot models are affected.
No product ranges from the sources yet.
1.01.32 (Linkind Matter Smart Plug), 3.15.21 (OREiN Matter Smart Light Bulb) and 3.30.17 (Linkind Wi-Fi Smart Light Bulb)1.01.32 (exact fixed version: unknown)3.15.21 (exact fixed version: unknown)3.30.17 (exact fixed version: unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.
This page as .md · .json · in your agent: get_signal("CVE-2026-78845")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.