Aidot smart home devices: Remote code execution via UPnP root description parsing

Summary

Several Aidot smart plugs and light bulbs contain a stack-based buffer overflow in the parsing of UPnP root description files. A malicious gateway or router on the local network that serves a crafted UPnP root description can trigger the overflow and execute code on the device without authentication. The CVE record states CVSS 9.8, but this score is not confirmed by NVD, whose analysis is deferred.

Affected

• Linkind Matter Smart Plug 1.01.32
• OREiN Matter Smart Light Bulb 3.15.21
• Linkind Wi-Fi Smart Light Bulb 3.30.17
• Other Aidot devices may be affected due to shared firmware code (unverified).

Fixed in

Unknown.

Workaround

• Disable UPnP on the device or in the router, if such a setting exists (unverified).
• Block UPnP and SSDP traffic from untrusted networks in the router or firewall.
• Place IoT devices in a separate VLAN or guest network.

Exploitation

• No known exploitation in the wild; not listed in CISA KEV.
• Public proof-of-concept code: sources conflict; one source reports none confirmed, and the researcher's GitHub repository contains a PoC script.
• CISA SSVC: exploitation PoC, automatable yes, technical impact total.

Our recommendation

• Create an inventory of Aidot devices in your network.
• Segment IoT devices from corporate systems and block UPnP/SSDP from the internet.
• Do not add port forwards to these devices.
• Apply the vendor firmware fix once Aidot publishes it, and check the vendor disclosure page for updates.
• Monitor the vendor and NVD for the final analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub repository AiDot-SSDP-UPnP-Vulnerabilities github.com
• Aidot Vulnerability Disclosure Policy www.aidot.com
• Strix CVE-2026-78845 www.strix.ai
• OpenCVE CVE-2026-78845 app.opencve.io
• VulDB CVE-2026-78845 exploit status vuldb.com
• Vulners CVE-2026-78845 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:20.