First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-56557

CriticalCVSS 9.1/10Last modified Nov 7, 2026

Description

An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://archive.org/details/tuya-matter-fabric-bug/mode/2upThird Party Advisory

Timeline

Published: Sep 16, 2025
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-565583.0The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_CVE-2025-56568.8A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been declared as critical. This vulnerability affects unknow CVE-2025-565627.5An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC a CVE-2025-565639.8A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controll CVE-2025-565657.6DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within no CVE-2025-565664.6MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker CVE-2025-565687.5Assertion failure vulnerability in the PCO (Protocol Configuration Options) parser in the SMF (Session Management Function) component of Ope CVE-2025-56578.8A vulnerability was found in PHPGurukul Complaint Management System 2.0. It has been rated as critical. This issue affects some unknown proc CVE-2025-565717.5Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursio CVE-2025-565727.5An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.CVE-2025-565778.4An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys.CVE-2025-565785.7An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authenticat

CVE-2025-56557: Critical severity, CVSS 9.1 | Vulnix