VulnerabilityPublished 29 Oct 2025Updated 13 Jan 2026

CVE-2025-56558: Dyson MQTT server · Unprotected Alternate Channel

Affects Dyson MQTT serverSource CVE Database V5

Not known to be exploited · CVSS 3.0 Low.

Data as of 26 Oct 2026, 12:55 UTC

CVSS 3.1 base score

3.0Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 31% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: High
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 29 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Dyson MQTT server	Affected =2022	Fixed in–

AI-suggested

To mitigate CVE-2025-56558, European organizations should implement the following specific measures: 1) Enforce strict device hygiene by ensuring that any Dyson device ownership transfer includes a complete factory reset or wipe to remove residual credentials and data. 2) Monitor and restrict access to AWS credentials associated with Dyson devices, employing network segmentation and encryption to prevent credential interception. 3) Update Dyson device firmware and server software to the latest versions, as vendor updates may have addressed this vulnerability or improved security controls. 4) Employ network monitoring tools to detect anomalous MQTT traffic patterns indicative of unauthorized publish/subscribe activity. 5) Limit the use of Dyson smart devices in critical or sensitive environments where unauthorized configuration changes could have operational impacts. 6) Educate users and administrators on the importance of secure credential management and device ownership protocols. 7) Engage with Dyson support or security advisories for any forthcoming patches or mitigations. These targeted actions go beyond generic advice by focusing on credential protection, device lifecycle management, and network monitoring specific to the Dyson MQTT ecosystem.

Description

The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.

Impact

For European organizations, the impact of CVE-2025-56558 is generally low but context-dependent. Organizations using Dyson smart devices, particularly Pure Hot+Cool models integrated into office or home environments, could face unauthorized manipulation of device settings if an attacker gains privileged access to AWS credentials and device serial numbers. This could lead to minor disruptions such as inappropriate room temperatures, potentially affecting comfort or operational conditions. However, the vulnerability does not allow code execution or data exfiltration, limiting risks to confidentiality and availability. The requirement for device ownership and credential interception significantly reduces the attack surface. Nonetheless, organizations with high security standards or critical environments should consider this vulnerability as a potential vector for low-impact integrity attacks. The lack of known exploits and vendor inability to reproduce the issue suggest limited practical risk, but vigilance is advised where Dyson devices are deployed at scale or in sensitive settings.

Summary

CVE-2025-56558 identifies a vulnerability categorized under CWE-420 (Unprotected Alternate Channel) in the Dyson MQTT server version 2022. The MQTT server facilitates communication between Dyson smart devices and clients via AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) and device serial numbers. The vulnerability arises because the server permits clients with valid AWS credentials and device serial numbers to publish and subscribe to MQTT topics for devices that have been removed from the MyDyson app, effectively bypassing expected device ownership controls. This flaw could allow an attacker who owns a Dyson device with full privileges to intercept AWS credentials (e.g., via network sniffing) and then transfer ownership of that device to a victim without wiping it. Consequently, the attacker can manipulate device settings such as room temperature (up to 37 Celsius) but cannot execute arbitrary code on the device or access sensitive information. The vendor reports inability to replicate the issue currently, indicating possible remediation or environmental factors limiting exploitation. The CVSS v3.1 score is 3.0 (low), reflecting the requirement for high privileges, network attack vector, and limited impact on integrity without affecting confidentiality or availability. No patches are currently linked, and no known exploits have been observed in the wild. This vulnerability primarily impacts the integrity of device configuration within a constrained operational scope.

CWE-420Unprotected Alternate Channel (opens in a new tab)
Base weakness
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
Architecture and Design
Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
OWASP ASVS 4.0.3
V1.14.1 (opens in a new tab)
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jan 2026, 21:51 UTC

WeaknessesCWE-420

Technical details

References

Community reviews

Related threats