CVE-2023-3028
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Insufficient authentication in the MQTT backend allows an attacker to access and manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models may also be affected.
Risk Assessment
The lack of authentication allows unauthorized connections, exposing the fleet's confidential data to access and manipulation by attackers. The ability to inject false data into the vehicle's CAN system poses a serious operational security risk.
Recommendation
It is recommended to implement authentication requirements for MQTT connections and to encrypt messages to secure telemetry data and prevent unauthorized access. All affected software versions should also be reviewed and updated.
Related vulnerabilities
- CVE-2026-71449Critical
A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.
- CVE-2026-18397Critical
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
- CVE-2026-55395Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.
- CVE-2026-55393Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.
- CVE-2026-56662Critical
In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.
- CVE-2026-56660Critical
In GetSimple CMS CE prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts it into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended directory.
- CVE-2026-14984Critical
Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.
- CVE-2026-104286CriticalActively exploited
A path traversal vulnerability in Fortinet FortiMail (versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9) stems from improper limitation of a pathname to a restricted directory. An unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.
- CVE-2026-102628Critical
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.
- CVE-2026-55083Critical
DHIS2 versions from 2.42.0 to before 2.42.5.1, and from 2.43.0 to before 2.43.0.1, are vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
Original NVD description (English source)
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend. The confirmed version is 201808021036, however further versions have been also identified as potentially impacted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS