CVE-2026-49199

CriticalCVSS 9.8

Published: 29/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.34%

68th percentile - higher than 68% of all known CVEs

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

An attacker can remotely gain full control over the device, posing a risk of system integrity compromise and data leakage.

Immediately update the software to a version that fixes this vulnerability and restrict access to MQTT brokers to trusted sources only.

Original NVD description (English source)

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.