{"id":"CVE-2026-78845","kind":"vulnerability","aliases":["CVE-2026-78845"],"related":[],"title":"Aidot smart plugs and bulbs: UPnP parsing flaw allows remote code execution","description":"Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.","summary":"Several Aidot Matter smart plugs and Wi-Fi/Matter light bulbs parse UPnP root descriptions unsafely. A network attacker who can send a crafted UPnP response to the device can run code on it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aidot","infrastructure","iot","linkind","matter","orein","smart-home","upnp"],"not_affected_if":["unknown"],"how_to_check":"- Check the firmware version shown in the Aidot or Linkind/OREiN app against `1.01.32` (Linkind Matter Smart Plug), `3.15.21` (OREiN Matter Smart Light Bulb) and `3.30.17` (Linkind Wi-Fi Smart Light Bulb)\n- Confirm whether the devices are on a shared network where untrusted hosts can reach them: unknown","fix":"- Update Linkind Matter Smart Plug to a version newer than `1.01.32` (exact fixed version: unknown)\n- Update OREiN Matter Smart Light Bulb to a version newer than `3.15.21` (exact fixed version: unknown)\n- Update Linkind Wi-Fi Smart Light Bulb to a version newer than `3.30.17` (exact fixed version: unknown)","status":"open","published_at":"2026-10-27T15:17:00+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","triaged_at":"2026-10-27T15:33:33+00:00","updated_at":"2026-10-27T15:33:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-27T15:33:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update Linkind Matter Smart Plug to a version newer than `1.01.32` (exact fixed version: unknown)\n- Update OREiN Matter Smart Light Bulb to a version newer than `3.15.21` (exact fixed version: unknown)\n- Update Linkind Wi-Fi Smart Light Bulb to a version newer than `3.30.17` (exact fixed version: unknown)","reach":"local","title":"Aidot smart plugs and bulbs: UPnP parsing flaw allows remote code execution","impact":"high","summary":"Several Aidot Matter smart plugs and Wi-Fi/Matter light bulbs parse UPnP root descriptions unsafely. A network attacker who can send a crafted UPnP response to the device can run code on it.","category":"infrastructure","nicknames":[],"who_cares":["aidot","linkind","orein","matter","smart-home","iot","upnp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code on the smart device via UPnP parsing","analyst_note":"Confirm the fixed firmware versions and the attack vector (local network versus internet) from the NVD entry or vendor advisory.","how_to_check":"- Check the firmware version shown in the Aidot or Linkind/OREiN app against `1.01.32` (Linkind Matter Smart Plug), `3.15.21` (OREiN Matter Smart Light Bulb) and `3.30.17` (Linkind Wi-Fi Smart Light Bulb)\n- Confirm whether the devices are on a shared network where untrusted hosts can reach them: unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Owners of the listed Aidot-branded Linkind, OREiN and Linkind Wi-Fi devices at or below the versions above. The sources do not say whether exposure requires being on the same local network as the device, so treat any device on a shared or guest network as potentially exposed. unknown whether other Aidot models are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":3343,"output_tokens":740,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-78845':15A,18A '/matter':38B '1.01.32':68C '3.15.21':74C '3.30.17':83C 'aidot':1A,19B,30B,62C 'allow':9A 'attack':48B 'bulb':5A,40B,73C,82C 'code':11A,61B,88C 'craft':53B 'cve':13A,16A 'descript':44B,94C 'devic':58B 'execut':12A,89C 'fi':37B,79C 'flaw':8A 'home':27B 'infrastructur':20B 'iot':21B 'light':39B,72C,81C 'linkind':22B,64C,76C 'matter':23B,31B,65C,70C 'network':47B 'orein':24B,69C 'pars':7A,41B,95C 'plug':3A,33B,67C 'product':63C 'rce':90C 'remot':10A,87C 'respons':55B 'root':43B,93C 'run':60B 'send':51B 'sever':29B 'smart':2A,26B,32B,66C,71C,80C 'smart-hom':25B 'unsaf':45B 'upnp':6A,28B,42B,54B,92C 'via':91C 'vulner':85C 'wi':36B,78C 'wi-fi':35B,77C","nicknames":[],"mitigations":[],"who_affected":"Owners of the listed Aidot-branded Linkind, OREiN and Linkind Wi-Fi devices at or below the versions above. The sources do not say whether exposure requires being on the same local network as the device, so treat any device on a shared or guest network as potentially exposed. unknown whether other Aidot models are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78845","severity":null,"published_at":"2026-10-27T15:17:00+00:00","modified_at":"2026-10-27T15:17:00+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}