CVE-2025-56557

Full vulnerability record from the local CVENow database.

Description

An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Modified

Source identifier

[email protected]

Published

2025-09-16 19:15:41.373000

Last modified

2026-11-07 18:10:00.200000

View original CVE JSON

{
  "id": "CVE-2025-56557",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-16T19:15:41.373",
  "lastModified": "2026-11-07T18:10:00.200",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol."
    },
    {
      "lang": "es",
      "value": "Un problema descubierto en la aplicación Tuya Smart Life 5.6.1 permite a los atacantes controlar sin privilegios dispositivos Matter a través del protocolo Matter."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-17T13:47:46.363262Z",
          "id": "CVE-2025-56557",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tuya:tuya:5.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE215C86-45FC-44CC-B54B-3633F9434172"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://archive.org/details/tuya-matter-fabric-bug/mode/2up",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}