Yeelight App Android CVE-2025-8210

Exploitation requires all of the following concrete conditions: (1) Physical or logical local access to the target Android device, with the Yeelight App (version 3.5.4 or earlier) installed; (2) User-level privileges (PR:L), meaning the attacker must already authenticate as a device user or have compromised a user-level process; (3) The com.yeelight.cherry component must be improperly exported in AndroidManifest.xml without android:exported=false or matching permission restrictions; (4) At least one attack-initiating application (e.g., the exploit script) must be installed on the same device or accessible via ADB shell. Exploitation is blocked or severely limited if: (a) the Yeelight App is not installed, (b) device lock-screen is enforced and device is locked, (c) SELinux or other MAC policies restrict inter-process communication, or (d) the Android version or security patch level introduces stricter component export validation.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 4.0 vector (AV:L/AC:L/PR:L) combined with extremely low EPSS (0.03%, 7th percentile) and a CVSS base score of 1.9 indicates a significant gap between theoretical attack surface and practical exploitability. The local attack vector (AV:L) is the primary limiting factor - exploitation requires either physical device access or a pre-existing compromise. The PR:L requirement means the attacker must already have legitimate user-level access to the device. The limited impact scope (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) confirms confidentiality impact only on the application itself, with no system-wide or inter-process consequence. The lack of active KEV status and negligible EPSS percentile suggest that despite public exploit disclosure, security researchers have not prioritized or actively weaponized this vector. Organizations should deprioritize this vulnerability below network-based or high-consequence local issues.

An attacker with local access to an Android device (either through physical possession or a separate device compromise granting ADB access) uses the publicly disclosed exploit to interact with unexported components of the Yeelight App's com.yeelight.cherry component. By sending crafted IPC messages via Android's Intent system, the attacker extracts sensitive application data or configuration details from the Yeelight App's internal storage accessible through the improperly exported component. This might reveal cloud credentials, device tokens, or user-specific IoT device identifiers, but cannot directly compromise system security or other applications.