(Pwn2Own) Amazon Smart Plug OTA Update Process Improper Certificate Validation Vulnerability

August 12th, 2026
ZDI-26-558 ZDI-CAN-28460

CVE ID

CVSS Score

6.8 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected Vendors

Amazon

Affected Products

Smart Plug

Vulnerability Details

This vulnerability allows network-adjacent attackers to bypass certificate validation for OTA updates on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of OTA updates. The issue results from the lack of certificate validation when downloading updates. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the device.

Additional Details

Fixed in Amazon Smart Plug version is 3.1.212
https://www.amazon.com/gp/help/customer/display.html?nodeId=T7PZ186qF8gift84NG


Disclosure Timeline

  • 2025-11-05 - Vulnerability reported to vendor
  • 2026-08-12 - Coordinated public release of advisory
  • 2026-08-12 - Advisory Updated

Credit

Team Neodyme (@Neodyme)

Back to Advisories