Two CVEs published on October 22 and 27, 2026 describe buffer overflows in the firmware of AiDot smart home devices, sold under the Linkind and OREiN brands. CVE-2026-78846 lets any device on the local network corrupt a plug's or bulb's memory with one crafted discovery reply. CVE-2026-78845 gives remote code execution to an attacker who controls or impersonates the router. The researcher has published proof-of-concept scripts, and no fixed firmware has been announced.

Which devices

The researcher's write-up lists three confirmed models:

  • Linkind Matter Smart Plug, firmware 1.01.38, on an ESP32-C2
  • OREiN Matter Smart Light Bulb, firmware 3.30.17, on an ESP32-C3
  • Linkind Wi-Fi Smart Light Bulb, firmware 3.30.17, on an ESP32-C3

The CVE record for CVE-2026-78845 names older versions: the plug with firmware 1.01.32 and the OREiN bulb with 3.15.21. The flaws are therefore present in at least two firmware versions of both devices. The researcher expects other AiDot devices to be vulnerable too, because the firmware reuses a lot of code across products. The flaw is in AiDot's own code, not in Espressif's chips or the Matter standard.

What goes wrong

Both bugs come from the same helper function. It copies the text between a start marker and an end marker into a fixed-size buffer, without checking how long that text is.

For CVE-2026-78846, the device sends an SSDP discovery request to the multicast address 239.255.255.250:1900 and parses the LOCATION header of the replies. A reply with an overly long LOCATION value overflows a heap buffer. Any device on the same network segment can send such a reply. The proof of concept demonstrates an arbitrary memory write. The CVE has a CVSS 3.1 score of 9.8.

CVE-2026-78845 sits in the parsing of the UPnP root description, the XML file a UPnP device publishes about itself. The device only fetches it from the local gateway, so the attacker has to control the router or pose as it. Over-long friendlyName, manufacturer, modelName or modelNumber fields overflow a 128-byte stack buffer, and the researcher's video shows control-flow hijacking on the Linkind plug.

What to do

EUVD and Armis list no patched version, and the researcher's write-up does not mention one either. EPSS rates the chance of exploitation in the next 30 days at well under 1%, and neither CISA nor the EU lists the bug as exploited. Still, public exploit code exists, and the attack needs no password.

  • Put these devices on a separate network or VLAN for IoT gear, away from computers and phones that could be compromised and used as a stepping stone.
  • Block SSDP (UDP 1900) between that segment and the rest of the network. This will not help against another compromised device on the same segment.
  • Check the AiDot app for firmware updates and watch the vendor's vulnerability disclosure page.

A Matter logo does not mean the whole firmware has been audited. These devices also run AiDot's own discovery and network code next to the Matter stack, and that is where both bugs live.