PT-2024-11934 · Mqtt · Mqtt

Published 2024-04-09 · Updated 2024-10-02 · CVE-2023-1083

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MQTT (affected versions not specified)

Description An unauthenticated remote attacker who is aware of an MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands, and firmware updates.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-1083

Affected Products

Mqtt

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-1083 · Security Note
• https://cert.vde.com/en/advisories/VDE-2024-009 · Note
• https://twitter.com/cracbot/status/1777930831329218646 · Twitter Post