CVE-2025-6522: Trendmakers Sight Bulb Pro Firmware Zj CG32-2201

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP protocol available on Port 16668. This vulnerability allows an attacker to run arbitrary commands on the Sight Bulb Pro by passing a well formed JSON string.

Affected products

• Trendmakers Sight Bulb Pro Firmware Zj CG32-2201: up to and including 8.57.83

Published 2025-06-27. Last modified 2026-06-17.