Skip to main content
VulnerabilityPublished

ZDI-26-558: (Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

Source Zero Day Initiative

0

Fixed in 3.1.212 : update affected systems when convenient.

Data as of 21 Aug 2026, 17:34 UTC

Severity
Medium

Rated Medium by Zero Day Initiative

Patch
Available – fixed in 3.1.212

What to do

AI-suggested

A fix is available in Amazon Smart Plug version 3.1.212. Users and administrators should update affected devices to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.

Description

This vulnerability allows network-adjacent attackers to bypass certificate validation for OTA updates on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8.

References

Community reviews

Loading reviews…