CVE-2026-22535
HighSummary
An attacker with network access and valid credentials can, due to the unsecured (unencrypted) MQTT protocol, write to server topics on the board controlling MQTT communications.
Risk Assessment
Risk of unauthorized modification of device configuration or control, potentially leading to system disruption.
Recommendation
Implement encryption for MQTT communication (e.g., TLS) and strengthen authentication mechanisms.
Other vulnerabilities in MQTT
See all- CVE-2026-69658Critical
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.
- CVE-2026-49199Critical
Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.
Original NVD description (English source)
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications