CVE-2023-33372

Vulnerability

Connected IO firmware versions v2.1.0 and prior contain a hard-coded username and password pair used for MQTT device communication [1]. This credential is embedded in the firmware, allowing any attacker who extracts it to authenticate to the MQTT broker.

Exploitation

An attacker with access to the hard-coded credentials can connect to the MQTT broker and send messages on behalf of any device, effectively impersonating them [1]. The same credentials are used to sign and verify JWT session tokens, enabling the attacker to forge arbitrary session tokens and bypass authentication.

Impact

Successful exploitation allows the attacker to impersonate devices and sign arbitrary JWT tokens, leading to authentication bypass and unauthorized access to device management functions [1]. The attacker can then perform actions as any legitimate device, potentially compromising the entire system.

Mitigation

Connected IO has not released a patch as of the publication date (2023-08-04) [1]. Users should monitor vendor advisories for firmware updates. As a workaround, network segmentation and MQTT broker access controls may limit exposure. The product page is available at [2] but no fix details are provided.