# CVE-2025-59452

## Summary

- **CVE ID:** CVE-2025-59452
- **Severity:** MEDIUM
- **CVSS Score:** 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
- **CWE:** CWE-340
- **Published:** Oct 6, 2025
- **Last Modified:** Mar 13, 2026

## Description

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.

## Affected Products

- YoSmart — YoLink API (0)

## References

- [CNA](https://shop.yosmart.com/pages/sa-2025-001)
- [CNA](https://bishopfox.com/blog/advisories)
- [CNA](https://shop.yosmart.com/pages/product-support)
- [CNA](https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.44%
- **EPSS Percentile:** 36.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._