CVE-2025-56400

{
  "id": "CVE-2025-56400",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-24T20:15:49.560",
  "lastModified": "2026-11-05T13:10:00.180",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en la implementación OAuth del SDK Tuya 6.5.0 para Android e iOS, afecta a las aplicaciones móviles Tuya Smart y Smartlife, así como a otras aplicaciones de terceros que integran el SDK, permite a un atacante vincular su propia cuenta de Amazon Alexa a la cuenta Tuya de una víctima. Las aplicaciones no validan el parámetro de estado OAuth durante el flujo de vinculación de cuentas, lo que permite un ataque similar a la Cross-Site Request Forgery (CSRF). Al engañar a la víctima para que haga clic en un enlace de autorización manipulado, un atacante puede completar el flujo OAuth en nombre de la víctima, lo que resulta en acceso no autorizado de Alexa a los dispositivos conectados a Tuya de la víctima. Esto afecta a los usuarios independientemente de la vinculación previa con Alexa y no requiere que la aplicación Tuya esté activa en ese momento. La explotación exitosa puede permitir el control remoto de dispositivos como cámaras, timbres, cerraduras de puertas o alarmas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-24T20:12:34.225757Z",
          "id": "CVE-2025-56400",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        },
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:smartlife:6.3.1:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "0CF67072-EEB4-450F-AF95-AD156911D384"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:smartlife:6.3.4:*:*:*:*:android:*:*",
              "matchCriteriaId": "04E6387D-69E1-45A0-B7D9-193FB792E119"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:tuya:*:*:*:*:*:android:*:*",
              "versionEndExcluding": "6.5.0",
              "matchCriteriaId": "61AEDA2E-C69C-45DB-899C-6A4BB5497CF3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:tuya:*:*:*:*:*:iphone_os:*:*",
              "versionEndExcluding": "6.5.0",
              "matchCriteriaId": "DF11CD85-42F0-47A4-998B-A666B8DA69FE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:tuya_smart:6.3.1:*:*:*:*:android:*:*",
              "matchCriteriaId": "C64E24CF-3387-4E95-9C42-84605B5CC230"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:tuya_smart:6.3.1:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "37DD5BCF-A48D-460D-90BC-AB7D59035558"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://src.tuya.com/announcement/30",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}