CVE-2026-33356

7.7 Élevée

Publiée le 11/05/2026 à 19:16 · Modifiée le 17/06/2026 à 12:37 · Analyse NVD reportée · Source : 44488dab-36db-4358-99f9-bc116477f914

Description

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

Traduire en français

Produits concernés

Meari IoT Cloud MQTT Broker EMQX

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.7 Élevée	44488dab-36db-4358-99f9-bc116477f914	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
https://www.runzero.com/advisories/meari-mqtt-broker-missing-per-device-subscribe-acl-cve-2026-33356/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories