CVE-2023-33379
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Connected IO version 2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication. This allows devices to connect to the broker and issue commands to other devices, impersonating the Connected IO management platform.
Risk Assessment
The organization may be exposed to unauthorized commands issued by devices, potentially leading to serious security and integrity issues within the system. Potential attacks could affect all Connected IO devices on the network.
Recommendation
It is recommended to upgrade to the latest version of Connected IO and review the configuration of the MQTT broker to secure communication between devices. Additionally, implement further authentication and authorization mechanisms.
Original NVD description (English source)
Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.