Dyson MQTT Server CVE-2025-56558

Exploitation requires a specific, pre-existing privileged relationship: the attacker must previously have owned the target Dyson device with full privileges and, while in control, captured the valid AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN and the device serial number. The device must then be transferred to the victim WITHOUT being wiped/factory-reset, and those sniffed credentials must remain valid afterward (the alternate MQTT channel still authorizes the removed device even when it no longer appears in the MyDyson app). Strong limiting factors: PR:H (attacker must have legitimately held the device), AC:H (credential sniffing plus an ownership-transfer sequence), the impact is bounded to configuration within the device safe operating range (temperature up to 37 Celsius) with no code execution and no data exfiltration, affected firmware is the ~2022 generation, and the vendor reports being unable to replicate the behavior.

All signals converge on LOW real-world risk despite the alarming IoT-takeover framing. CVSS base is only 3.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N): network vector but HIGH attack complexity and HIGH privileges, with only a Low integrity impact and no confidentiality or availability impact. EPSS is 0.38% (29th percentile), consistent with the low severity. There is NO CISA KEV listing and NO public exploit code, so exploitation status is: no public exploit identified at time of analysis. Crucially the signals are consistent, not conflicting: the description, CVSS PR:H, and AC:H all agree that an attacker must first legitimately own the device with full privileges, passively capture the AWS credentials/serial, and then socially engineer an ownership transfer to the victim without the device being wiped - a long, improbable chain. The vendor (Dyson) disputes the issue, stating it is a potential ~2022-era flaw they can no longer replicate; it is NOT independently confirmed as currently reproducible. Net: this is a genuinely low-priority, low-impact issue, not a high-CVSS-but-hidden-risk case - the CVSS score itself is already low and matches reality. The only caveat: the NVD-assigned Scope:Changed inflates the score slightly, and the realistic ceiling of harm is merely setting room temperature within the device safe range.

A malicious prior owner of a Dyson Pure Hot+Cool device sniffs the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN and device serial while they still control it, then sells or transfers the un-wiped device to a victim. Retaining those still-valid credentials, the attacker connects to the Dyson MQTT broker and publishes commands to adjust the victim room temperature (up to 37 Celsius). No public exploit code exists, and AC:H/PR:H make this a bespoke, low-likelihood scenario rather than a scalable attack.