A vulnerability in the Dyson MQTT server could allow unauthorized actors to control device settings if ownership is transferred without wiping the hardware.

This vulnerability is an unprotected alternate channel (CWE-420) where an authenticated user with high privileges can maintain access to a device after it has been transferred to a new owner, provided the original AWS credentials and device serial number are known.

The impact of this vulnerability is limited to unauthorized configuration of specific Dyson devices, such as modifying temperature settings within safe operating ranges. While this does not result in code execution or sensitive data theft, it represents a breakdown in secure ownership transfer processes, which could lead to consumer frustration and potential reputational damage for the vendor. The CVSS score of 7.5 reflects a high severity rating, though the practical risk is mitigated by the requirement for specific, pre-existing credentials and physical device state management.

Immediate Action: Ensure all Dyson devices are factory reset and properly removed from the previous owner's MyDyson account before transferring ownership to a new user.

Proactive Monitoring: Monitor for unexpected device configuration changes and verify that devices are correctly de-registered from legacy cloud accounts.

Compensating Controls: Utilize network segmentation to isolate IoT devices from critical business infrastructure to limit the potential reach of any compromised peripheral.

Public Exploit Available: Unknown

While the technical risk is constrained by the necessity of prior credential knowledge and device transfer circumstances, users should adopt a security-first approach to hardware decommissioning. Always perform a comprehensive factory reset on smart devices to clear stored AWS session tokens and credentials before changing ownership. Implementing these standard hygiene practices will effectively neutralize the risk posed by this legacy server configuration.