CVE-2025-29659: Yiiot Xy-3820 Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.

Affected products

• Yiiot Xy-3820 Firmware: version 6.0.24.10 only

Published 2025-04-21. Last modified 2026-06-17.