Amazon Smart Plug Vulnerable to Remote Code Execution via OTA Update Flaw
A critical vulnerability in Amazon Smart Plug allows network-adjacent attackers to achieve remote code execution by exploiting flaws in its Over-The-Air (OTA) update process.
A significant security vulnerability has been identified in Amazon's Smart Plug devices, potentially allowing attackers to gain control of the devices remotely. The flaw, detailed by the Zero Day Initiative (ZDI) as ZDI-26-559, resides within the device's mechanism for processing Over-The-Air (OTA) updates. This vulnerability has been assigned a CVSS score of 7.5, indicating a high level of risk.
The core of the issue lies in an out-of-bounds write vulnerability that occurs due to insufficient validation of data provided during the OTA update process. Attackers can exploit this by sending malformed update data, causing the device to write data beyond the allocated buffer. This overflow can then be leveraged to overwrite critical memory regions, ultimately leading to the execution of arbitrary code in the context of the device's operating system.
Crucially, the exploitation of this vulnerability does not require any form of authentication. This means that an attacker who is network-adjacent to an affected Amazon Smart Plug could potentially compromise it without needing any prior access or credentials. The ease of exploitation, combined with the lack of authentication, significantly increases the potential impact and the likelihood of widespread abuse.
Team Neodyme, the researchers credited with discovering this vulnerability, reported it to Amazon on November 5, 2025. Following a coordinated disclosure process, the Zero Day Initiative published its advisory on August 12, 2026, alongside an update to the advisory on the same day. This timeline indicates a significant period between the initial discovery and public disclosure, allowing Amazon time to develop and distribute a fix.
Amazon has addressed this vulnerability by releasing version 3.1.212 of the Smart Plug firmware. Users are strongly advised to ensure their Amazon Smart Plug devices are updated to this latest version to mitigate the risk. Further details on updating the device can be found on Amazon's support pages.
This vulnerability underscores the ongoing security challenges associated with the Internet of Things (IoT) ecosystem. Smart home devices, often overlooked in security assessments compared to traditional IT infrastructure, present attractive targets for attackers due to their connectivity and the sensitive data they may handle or provide access to. The ability to execute code on these devices can lead to a range of malicious activities, from network reconnaissance and lateral movement to using the device as a pivot point for further attacks.
The discovery by Team Neodyme and the subsequent advisory from ZDI highlight the critical role of independent security researchers and bug bounty programs in identifying and rectifying such flaws before they can be widely exploited. The prompt patching by Amazon, while necessary, also serves as a reminder for consumers to maintain vigilance regarding firmware updates for all their connected devices.
This advisory details a separate information disclosure vulnerability (ZDI-26-557) affecting the Amazon Smart Plug, distinct from the previously reported remote code execution flaw. The new vulnerability, rated with a CVSS score of 4.3, allows network-adjacent attackers to reveal sensitive information by exploiting an insecure fallback in the device's distress beaconing process. While not leading to code execution on its own, it could be chained with other vulnerabilities.
This advisory from Zero Day Initiative provides further technical details on the Amazon Smart Plug vulnerability, ZDI-26-558, which affects the Over-The-Air (OTA) update process. The vulnerability stems from improper certificate validation during update downloads, allowing network-adjacent attackers to potentially deploy unauthorized firmware. The issue has been fixed in Amazon Smart Plug version 3.1.212.