CVE-2026-33356
Meari MQTT broker missing per-device subscribe ACL
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
11 may 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Meari · IoT Cloud MQTT Broker EMQX¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →