MQTT vulnerabilities

An attacker with network access and valid credentials can, due to the unsecured (unencrypted) MQTT protocol, write to server topics on the board controlling MQTT communications.

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.