Sinilink XY-WFT1 Firmware 1.3.6
Approved changes feed: RSS · Atom
cpe:2.3:o:sinilink:xy-wft1_firmware:1.3.6:*:*:*:*:*:*:*
part: o version: 1.3.6 update: *
| Vendor | Sinilink (15ce21e9-85e9-57d3-b1fe-8d302c86629b) |
|---|---|
| Product | Xy Wft1 Firmware (b48fae46-451a-5c83-88bf-4952509f62ce) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-43704 |
vulnerable | 2026-06-08 05:49:33.854379 |
Details available
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
Published: 2023-01-20T00:00:00.000Z
Updated: 2025-04-02T16:02:55.110Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.