(Pwn2Own) Amazon Smart Plug Insecure Fallback Information Disclosure Vulnerability

August 12th, 2026
ZDI-26-557 ZDI-CAN-28367

CVE ID

CVSS Score

4.3 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Vendors

Amazon

Affected Products

Smart Plug

Vulnerability Details

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the distress beaconing process. The issue results from the device falling back to a less secure state. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.

Additional Details

Fixed in Amazon Smart Plug version is 3.1.212
https://www.amazon.com/gp/help/customer/display.html?nodeId=T7PZ186qF8gift84NG


Disclosure Timeline

  • 2025-11-05 - Vulnerability reported to vendor
  • 2026-08-12 - Coordinated public release of advisory
  • 2026-08-12 - Advisory Updated

Credit

Team Neodyme (@Neodyme)

Back to Advisories