1906 matches found
CVE-2025-4384
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take...
CVE-2025-4384
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take...
CVE-2025-4384 Certificate validity not properly verified
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take...
CVE-2025-4384 Certificate validity not properly verified
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take...
CVE-2025-4384
The CVE-2025-4384 issue affects the PcVue MQTT add-on, where certificate validation fails to confirm that a remote device’s certificate is not expired or not yet valid. Root cause: improper certificate validity checks during TLS handshake. Impact: malicious devices could present certificates that...
PT-2025-19957 · Pcvue · Pcvue
Name of the Vulnerable Software and Affected Versions: PcVue affected versions not specified Description: The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are...
curl: Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet
Title: Buffer Overflow in curl MQTT Test Server mqttd.c via Malicious CONNECT Packet Description The MQTT test server mqttd.c in the curl project contains a buffer overflow vulnerability due to improper validation of password length fields in MQTT CONNECT packets. An attacker can craft a maliciou...
curl: Double free caused by mqtt_doing()
mqttdoing lib/mqtt.c causes a double free under certain conditions. The conditions are 1 an mqttsend is unable to send its entire buffer at one time; and 2 the next call to mqttsend fails. The bug arises because mqttdoing frees the pointer mq-sendleftovers without nulling it line 755. Source belo...
[SECURITY] Fedora 42 Update: mosquitto-2.0.21-1.fc42
Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version v5 and 3.1.x. MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...
CVE-2024-52285
A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...
CVE-2025-27615
umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...
CVE-2024-52285
A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...
CVE-2024-52285
Siemens SiPass integrated AC5102 (ACC-G2) and ACC-AP devices (all versions
CVE-2024-52285
A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...
ABB RMC-100
SUMMARY An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. 2. WORKAROUNDS The vulnerability is only present when the REST interface is enabled...
CVE-2025-27615
umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...
CVE-2024-50688
SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...
CVE-2024-50696
SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...
CVE-2024-50696
SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...
CVE-2024-50688
SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...