PT-2025-19957 · Pcvue · Pcvue

Name of the Vulnerable Software and Affected Versions: PcVue affected versions not specified Description: The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are...

curl: Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet

Title: Buffer Overflow in curl MQTT Test Server mqttd.c via Malicious CONNECT Packet Description The MQTT test server mqttd.c in the curl project contains a buffer overflow vulnerability due to improper validation of password length fields in MQTT CONNECT packets. An attacker can craft a maliciou...

curl: Double free caused by mqtt_doing()

mqttdoing lib/mqtt.c causes a double free under certain conditions. The conditions are 1 an mqttsend is unable to send its entire buffer at one time; and 2 the next call to mqttsend fails. The bug arises because mqttdoing frees the pointer mq-sendleftovers without nulling it line 755. Source belo...

[SECURITY] Fedora 42 Update: mosquitto-2.0.21-1.fc42

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version v5 and 3.1.x. MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

CVE-2024-52285

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...

CVE-2025-27615

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2024-52285

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...

CVE-2024-52285

Siemens SiPass integrated AC5102 (ACC-G2) and ACC-AP devices (all versions

CVE-2024-52285

A vulnerability has been identified in SiPass integrated AC5102 ACC-G2 All versions V6.4.8, SiPass integrated ACC-AP All versions V6.4.8. Affected devices expose several MQTT URLs without authentication. This could allow an unauthenticated remote attacker to access sensitive data...

ABB RMC-100

SUMMARY An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop. 2. WORKAROUNDS The vulnerability is only present when the REST interface is enabled...

CVE-2025-27615

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-50696

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...

CVE-2024-50696

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-50696

SunGrow WiNet-S firmware upgrade process lacks integrity checking for updates in V200.001.00.P025 and earlier. A crafted MQTT message can trigger installation of a bogus firmware file hosted on an attacker-controlled server, potentially compromising an inverter or WiNet connectivity dongle. Affec...

CVE-2024-50696

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-50688

SunGrow iSolarCloud Android app (v2.1.6.20241017 and earlier) uses hardcoded MQTT credentials for device telemetry, with the same credentials in the app and cloud. The vulnerability is described as enabling attackers to gain unauthorized access to user accounts and potentially execute arbitrary c...