CVE-2025-56558
Dyson · published 2025-10-29
Source record Collected from the National Vulnerability Database (NVD)
Description
Description by MITRE via the CVE Program.
The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.
Filed by MITRE; not a statement by Dyson.
Status at the source
- NVD status: Deferred — NVD has not analysed this CVE.
- CVE tag (from MITRE): disputed
- CVE tag (from MITRE): exclusively-hosted-service
Affected products, as the source lists them
| Vendor | Product | Versions |
|---|---|---|
| Dyson | MQTT server | 2022: affected |
DeSpy has not checked any unit, hardware revision or firmware. A product missing here is not a statement that it is unaffected.
Scores, as their sources published them
- CVSS 3.1: 3 LOW — as published by MITRE (Secondary)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N - SSVC — CISA's assessment (SSVC 2.0.3, CISA Coordinator): Exploitation: none · Automatable: no · Technical impact: partial
DeSpy does not score records. These are the sources' own values.
Weaknesses
Sources
References the source lists
- https://archive.org/details/dyson-acpolicy-bug-report
- https://support.dyson.com.au/supporthome/Air-Treatment/Purifier/pure-hot-cool-link/385276-01/troubleshooting/machine-is-not-heating
- https://www.dyson.co.uk/support/reporting-data-security-issues
- https://www.dyson.com/air-treatment/air-purifier-heaters/pure-hot-cool-hp04
Source dates: published 2025-10-29, last changed 2026-10-08. DeSpy's copy of this version is dated 2026-10-08.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.