ZDI 2026-08-12

ZDI-26-559: (Pwn2Own) Amazon Smart Plug OTA Update Process Out-Of-Bounds Write Remote Code Execution Vulnerability

Machine-generated analysis · WAYSCloud LLM

Unauthenticated attackers on the same network can trigger an out-of-bounds write via the OTA update process.

Context

The advisory concerns the Amazon Smart Plug. It describes an out-of-bounds write in the OTA update process that enables remote code execution. The exploit requires no authentication and can be performed by a network-adjacent attacker.

Operator considerations

Check: Verify the firmware version of each Amazon Smart Plug for the vulnerable OTA update code.
Isolate: Place affected plugs on a segregated network segment or restrict access to trusted hosts.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Amazon Smart Plug. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Read the full advisory on ZDI →