CVE-2026-79389
UnknownSummary
Trueview T18161 S 6.0.23.4 contains improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.
Risk Assessment
Lack of proper verification may allow an attacker to execute unauthorized commands, potentially leading to dangerous device actions or security breaches.
Recommendation
Implement integrity and authentication mechanisms for MQTT messages, such as digital signatures and timestamp verification.
Other vulnerabilities in Trueview
See all- CVE-2026-79391Unknown
The MQTT service in Trueview 6.0.23.4 has no authentication. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations.
- CVE-2026-79390Unknown
Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational data, including device identifiers, message metadata, and control-related information.
Original NVD description (English source)
Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.