Skip to main content
VulnerabilityPublished

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

Source Zero Day Initiative

0

Fixed in 3.1.212 : patch affected systems soon.

Data as of 21 Aug 2026, 17:34 UTC

Severity
High

Rated High by Zero Day Initiative

Patch
Available – fixed in 3.1.212

What to do

AI-suggested

A vendor-provided fix is available in Amazon Smart Plug version 3.1.212. Users and administrators should update affected devices to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

References

Community reviews

Loading reviews…