External risk intelligence

Aidot and OREiN Smart Devices UPnP RCE Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78845

The vulnerability involves UPnP parsing in smart home IoT devices. While these devices are designed for local network connectivity and discovery via UPnP, they are not typically exposed directly to the public internet by design. However, they are often reachable via misconfigured routers or specific gateway setups that expose UPnP services, making internet reachability possible in some deployment scenarios.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in certain smart home devices that could allow remote code execution. This means an attacker could potentially take control of these devices over a network without any user interaction. The main concern at this time is confirming if these specific devices are in use and if they are exposed in a way that makes them reachable.

Flaw lets attackers control smart devices remotely.
Critical risk if these specific smart devices are used.
Confirm device relevance and exposure to the network.

Attack Path

How an attacker could exploit the issue

An attacker could remotely trigger a vulnerability in smart home devices by sending specially crafted network messages. This could allow them to execute arbitrary code on the affected devices, potentially leading to a compromise of the user's smart home environment.

Entry condition: Network exposure.
Trigger point: UPnP description parsing.
Resulting risk: Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on affected smart home devices when they parse a specially crafted UPnP description. This could impact the device's functionality and potentially any integrated services or data it manages, when exposed to a network with malicious UPnP servers.

Smart home device functionality.
Remote code execution via UPnP.
Disruption of device operation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this critical vulnerability likely falls to teams managing IoT device fleets, such as platform or infrastructure teams, alongside the security team for broader exposure analysis. The immediate first step is to discover all instances of the affected smart plugs and bulbs, assess their network reachability and business criticality, and then confirm the specific owner responsible for each device or group of devices before planning remediation.

Device owners and security teams.
Verify device reachability and criticality.
Plan phased remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linkind and OREiN software affected by CVE-2026-78845?

These products are smart home IoT devices, specifically the Linkind Matter Smart Plug (version 1.01.32), OREiN Matter Smart Light Bulb (version 3.15.21), and Linkind Wi-Fi Smart Light Bulb (version 3.30.17). Users rely on these items to automate and manage lighting and power outlets within a home or office environment, typically connecting them to a local wireless network for control and integration with smart home ecosystems.

What does CVE-2026-78845 mean for device security?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In plain English, the device has a flaw in how it processes certain incoming data. When the device receives a specifically crafted UPnP (Universal Plug and Play) message, it may mistakenly execute code contained within that message. This allows an attacker to gain unauthorized control over the smart bulb or plug, bypassing normal security restrictions.

How is this smart device vulnerability triggered?

An attacker triggers this flaw by sending a malicious UPnP root description to the device over the network. The vulnerability exists specifically within the device's parsing logic for these messages. Importantly, simply having the device on a network does not trigger the bug; the device must actively receive and process the malformed UPnP message crafted by an attacker to execute the arbitrary code.

Do I need to worry if my devices are only on an internal network?

While these devices are intended for local network use, Halo Surface Signal notes that internet reachability is possible if your router or gateway is misconfigured to expose UPnP services. Devices that are fully isolated from the internet are at a lower risk than those with misconfigured network gateways that might allow external traffic to reach the local smart home network.

What should I do if I use these smart plugs or bulbs?

Begin by creating an inventory of all deployed Linkind and OREiN devices within your environment. Verify whether these devices are reachable from outside your local network through router settings or gateway configurations. Once you have identified which devices are in use and how they are connected, monitor for any official vendor updates or guidance regarding these specific product versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.