AiDot devices: Heap-based buffer overflow in SSDP LOCATION header parsing
Summary
Multiple AiDot smart devices fail to limit the size of the LOCATION header when parsing SSDP discovery responses, which causes a heap-based buffer overflow. A device on the local network can send a crafted SSDP response to trigger the overflow, which can allow an arbitrary write on the device. The official CVSS score is 9.8 (critical), but NVD analysis is still deferred.
Affected
- Tested per the linked GitHub repository: Linkind Matter Smart Plug, firmware 1.01.38 (ESP32-C2)
- Tested per the linked GitHub repository: OREiN Matter Smart Light Bulb, firmware 3.30.17 (ESP32-C3)
- Tested per the linked GitHub repository: Linkind Wi-Fi Smart Light Bulb, firmware 3.30.17 (ESP32-C3)
- Other AiDot devices are likely affected due to shared code, but this is unconfirmed.
Fixed in
Unknown.
Workaround
- No vendor-confirmed workaround.
- Place IoT devices in a separate VLAN or guest network.
- Block UDP port 1900 (SSDP) traffic from untrusted network segments.
- Disable UPnP on the router where it is not needed.
Exploitation
- The CISA SSVC assessment lists exploitation as none and automatable as yes.
- No known exploitation in the wild.
- The linked GitHub repository contains a file named CVE-2026-78846.py; its content was not verified.
Our recommendation
- Create an inventory of all AiDot devices in the environment and record their firmware versions.
- Segment these devices from sensitive systems and restrict UPnP and SSDP traffic.
- Check the vendor and NVD for an advisory and a fixed firmware version, and update as soon as one is available.
- Monitor the network for unusual SSDP traffic.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AiDot SSDP/UPnP vulnerabilities (GitHub) github.com
- AiDot Vulnerability Disclosure Policy www.aidot.com
- Strix: CVE-2026-78846 www.strix.ai
- VulDB entry 425312 vuldb.com
- Vulners: PT-2026-121402 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:02.
Original description (NVD)
Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.