MQTT Broker vulnerabilities

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker, resulting in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.

Missing authentication in the MQTT broker allows an unauthenticated remote attacker to access the broker, which is only protected from external access by a firewall. This may lead to full compromise of the device.

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). Any client can subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.