CVE-2023-33372
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware for device communication using MQTT. An attacker who gains access to these credentials can connect to the MQTT broker and send messages on behalf of devices, impersonating them.
Risk Assessment
Access to hard-coded credentials allows attackers to sign arbitrary JWT session tokens, enabling them to bypass authentication and potentially take control of devices.
Recommendation
It is recommended to remove hard-coded credentials from the firmware and implement more secure authentication methods for MQTT communication.
Original NVD description (English source)
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.