CVE-2026-78846 Details
Description
Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
A heap-based buffer overflow vulnerability has been identified in the AiDot Linkind Matter Smart Plug, specifically in version 1.01.32. This vulnerability arises from improper parsing of the 'LOCATION' header in incoming Simple Service Discovery Protocol (SSDP) messages. When the device processes these malformed SSDP responses, it can lead to arbitrary write conditions, potentially allowing for further exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xee9f00/AiDot-SSDP-UPnP-Vulnerabilities | [email protected] | BundleExploitTechnical Analysis |
| https://www.aidot.com/vulnerability-disclosure-policy | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| AiDot Linkind Matter Smart Plug | 1.01.38 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | CVE Modified | [email protected] |
| Oct 22, 2026 | New CVE Received | [email protected] |