PT-2025-42521 · Mqttx · Mqttx

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-62413

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MQTTX version 1.12.0

Description MQTTX, an MQTT 5.0 desktop client and testing tool, contains a flaw where improperly handled MQTT message payloads can lead to Cross-Site Scripting (XSS). Malicious payloads with HTML or JavaScript could be rendered in the MQTTX message viewer, potentially allowing attackers to execute scripts within the application's user interface. This could lead to unauthorized access to MQTT connection credentials or the triggering of unintended actions. The issue is particularly relevant in untrusted or multi-tenant environments where message content is not fully controlled.

Recommendations Update to MQTTX version 1.12.1.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62413

GHSA-29GF-9R9V-J4M3

Affected Products

Mqttx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62413.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62413 · Security Note
• https://github.com/emqx/MQTTX/security/advisories/GHSA-29gf-9r9v-j4m3 · Note
• https://github.com/emqx/MQTTX/commit/2963f78a4b3227cdb93597f546a75b75dee1059f · Note
• https://twitter.com/CVEnew/status/1978926558929687002 · Twitter Post
• https://t.me/CVEtracker/35135 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978987390417916030 · Twitter Post