Vulnerability Spotlight: How misusing properly serialized data opened TCL Link Hub Mesh Wi-Fi system to 17 vulnerabilities
Summary: Cisco Talos disclosed 17 vulnerability reports covering 41 unique CVEs in the TCL LinkHub Mesh Wi-Fi system, which is managed only through a phone app that communicates using Proto Buffers serialization. Talos found the devices use the serial number as the authentication password, and that serial number can be requested without any permissions, so it does not function as authentication at all.
What you should know: An attacker who can request the device serial number without permission holds the only credential the system checks, and Talos says exploitation could inject code at the operating system level, steal credentials, or cause a denial of service across the entire mesh network - with no official fix from TCL at the time of disclosure.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026