CVE-2026-105822 Server-Side Request Forgery in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT proxy contains a server-side request forgery SSRF vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server...

CVE-2026-105822

The Tapo Cloud MQTT proxy is susceptible to a Server-Side Request Forgery (SSRF) vulnerability because it fails to perform sufficient input validation on user-controlled host values. An attacker can exploit this flaw to force the Tapo Cloud service to send requests to an attacker-controlled serve...

CVE-2026-105821 Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo devic...

CVE-2026-105821

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated devices to request service tokens. The root cause is that the broker fails to verify if the device ID provided in a proxy request matches the authenticated device. An attacker owning a...

CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…

The Tapo Cloud MQTT proxy contains a server-side request forgery SSRF vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server...

CVE-2026-33356: Authorization Bypass Through User-Controlled Key

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization a...

CVE-2025-15574: Use of Insufficiently Random Values

When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket device / the QR code on the device. The password is derived from the "registration number" using a proprietary XOR/transposition algorithm...

EUVD-2025-1813

Malicious code in bioql PyPI...

CVE-2025-0681

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications...

CVE-2025-0681

CVE-2025-0681 concerns New Rock Technologies Cloud Connected Devices. The Cloud MQTT service supports wildcard topic subscriptions, enabling an attacker to tap service communications and potentially obtain sensitive information. Documented impact is information disclosure via local access to the ...

PT-2025-4000 · New Rock Technologies · Mx8G Voip Gateway +2

Name of the Vulnerable Software and Affected Versions: Affected products affected versions not specified Description: The Cloud MQTT service of the affected products supports wildcard topic subscription, which could allow an attacker to obtain sensitive information from tapping the service...

CVE-2025-0681: Improper Neutralization of Wildcards or Matching Symbols

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications...