CVE-2026-79391
UnknownSummary
The MQTT service in Trueview 6.0.23.4 has no authentication. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations.
Risk Assessment
An attacker can take control of MQTT communication, publish false data, or eavesdrop on sensitive information, potentially leading to data integrity and confidentiality breaches.
Recommendation
Enable authentication on the MQTT broker and restrict access to port 1883 to trusted devices only.
Other vulnerabilities in Trueview
See all- CVE-2026-79390Unknown
Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational data, including device identifiers, message metadata, and control-related information.
- CVE-2026-79389Unknown
Trueview T18161 S 6.0.23.4 contains improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.
Original NVD description (English source)
No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations.