CVE-2023-33379

Vulnerability

Connected IO v2.1.0 and prior contains a misconfiguration in the MQTT broker used for management and device communication. This allows unauthorized devices to connect to the broker and impersonate the Connected IO management platform. The vulnerability affects all versions up to and including v2.1.0 [1].

Exploitation

An attacker with network access to the MQTT broker can connect as a legitimate device. Then, by impersonating the management platform, they can issue arbitrary commands to any device connected to the broker. No authentication bypass or additional privileges are required beyond network connectivity [1].

Impact

Successful exploitation enables an attacker to send commands to all of Connected IO's devices, effectively gaining full control over affected devices. This can lead to unauthorized actions, data manipulation, or disruption of services [1].

Mitigation

As of the publication date, no official fix or mitigation has been disclosed in the available references. Users should monitor vendor updates and consider network-level controls to restrict MQTT broker access [1].