Skip to main content
VulnerabilityPublished

ZDI-26-557: (Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

Source Zero Day Initiative

0

Fixed in 3.1.212 : update affected systems when convenient.

Data as of 21 Aug 2026, 17:34 UTC

Severity
Medium

Rated Medium by Zero Day Initiative

Patch
Available – fixed in 3.1.212

What to do

AI-suggested

A fix is available in Amazon Smart Plug version 3.1.212. Users and administrators should update to this version to remediate the vulnerability. No additional vendor advisories indicate further mitigation steps or that no action is required.

Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.3.

References

Community reviews

Loading reviews…