Yandex has rolled out an automatic security update affecting millions of its smart speakers and the majority of partner televisions running YaOS. The patches were deployed between 21 and 23 October without user intervention.
The root cause was a set of compromised certificates from eMudhra. Private keys belonging to eight intermediate certificate authorities were simple integers ranging from 1 to 255, allowing trivial brute-force recovery instead of computationally expensive attacks.
With the recovered keys, an attacker could issue fraudulent certificates and intercept or modify HTTPS traffic destined for the devices. On Yandex Stations, researchers showed that server configuration could be replaced, the ADB debug interface enabled, and root access obtained.
Yandex clarified that remote exploitation against another user’s device also requires prior control of network traffic, for example through a compromised home router. The update removes trust in the dangerous certificates, overwrites affected system files, and permanently closes the ADB vector.
Users are warned that a factory reset restores the original firmware containing the vulnerability until the device reconnects and receives the patch again. Yandex therefore recommends avoiding resets unless absolutely necessary.
