CVE-2026-33356

Executive Summary

CVE-2026-33356 is a critical authorization bypass vulnerability in Meari IoT Cloud MQTT Broker deployments running EMQX 4.x. The flaw allows any authenticated low-privilege account to subscribe to global wildcard topics, thereby receiving telemetry data from devices the user does not own. While the broker enforces publish restrictions, it fails to enforce equivalent subscribe authorization at the per-device scope. This leads to unauthorized data access, potentially exposing sensitive IoT telemetry such as sensor readings, device status, and location data. The vulnerability has a CVSS score of 7.7 (High) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the potential for data leakage.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – An attacker needs only a low-privilege authenticated account.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Unauthorized access to sensitive telemetry data is possible.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: High. The vulnerability allows unauthorized data access with low privileges, making it attractive for espionage and reconnaissance in IoT environments.

Deep Dive & Mechanics

The vulnerability resides in the MQTT broker's authorization logic within EMQX 4.x. MQTT uses a publish/subscribe model where clients can publish messages to topics and subscribe to topics to receive messages. The broker is responsible for enforcing access control lists (ACLs) to ensure that clients can only publish to or subscribe to topics they are authorized for.

In this case, the broker correctly enforces publish restrictions, meaning a low-privilege user cannot publish messages to topics they do not own. However, the subscribe authorization is not enforced at the per-device scope. This means that when a client subscribes to a global wildcard topic (e.g., # or +/+/+/telemetry), the broker does not check whether the client is authorized to receive messages from specific devices. As a result, any authenticated low-privilege user can subscribe to all telemetry topics and receive data from every device in the MQTT broker's namespace.

The root cause is a missing or incomplete ACL check in the subscription authorization flow. The broker likely checks if the client is allowed to subscribe to a topic pattern but does not verify that the client owns or is permitted to access the specific devices that publish to those topics.

Vulnerable vs. Patched Code

Since no patch is available, the following is a conceptual comparison.

Vulnerable Code (EMQX 4.x - subscription authorization):

% In emqx_access_control.erl or similar
check_subscribe_acl(ClientInfo, Topic) ->
    case emqx_acl:check_acl(ClientInfo, subscribe, Topic) of
        allow -> allow;
        deny -> deny
    end.

This code only checks if the client is allowed to subscribe to the topic pattern, but does not verify device ownership.

Patched Code (Conceptual):

% Patched version
check_subscribe_acl(ClientInfo, Topic) ->
    case emqx_acl:check_acl(ClientInfo, subscribe, Topic) of
        allow ->
            % Additional check: verify client owns the device
            case is_client_authorized_for_device(ClientInfo, Topic) of
                true -> allow;
                false -> deny
            end;
        deny -> deny
    end.

is_client_authorized_for_device(ClientInfo, Topic) ->
    % Extract device ID from topic and check ownership
    DeviceId = extract_device_id(Topic),
    emqx_device_registry:is_device_owned_by(DeviceId, ClientInfo).

The patched version adds a device ownership check after the initial ACL check, ensuring that the client is authorized to receive data from the specific device.

Exploitation & Lab Setup

Red Team

Objective: Subscribe to global wildcard topics to exfiltrate telemetry data from all devices.

Prerequisites:

• A low-privilege MQTT account (e.g., username: attacker, password: password123).
• Network access to the MQTT broker (typically port 1883 for MQTT or 8883 for MQTT over TLS).

Steps:

1. Connect to the MQTT broker using an MQTT client (e.g., mosquitto_sub):

   mosquitto_sub -h <broker_ip> -p 1883 -u attacker -P password123 -t "#" -v
   

   The # wildcard subscribes to all topics.

2. Alternatively, subscribe to a more specific wildcard to reduce noise:

   mosquitto_sub -h <broker_ip> -p 1883 -u attacker -P password123 -t "devices/+/telemetry" -v
   

3. Monitor the output for telemetry data such as sensor readings, device status, and location information.

4. Exfiltrate data by logging the output to a file:

   mosquitto_sub -h <broker_ip> -p 1883 -u attacker -P password123 -t "#" -v > exfiltrated_data.log
   

Expected Outcome: The attacker receives all MQTT messages published to any topic, including those from devices they do not own.

Blue Team

Objective: Detect and prevent unauthorized subscription attempts.

Detection Steps:

1. Monitor MQTT subscription requests for wildcard topics (#, +) from low-privilege users.
2. Implement logging of all subscription attempts in EMQX:

   # Enable subscription logging in emqx.conf
   log.level = debug
   log.handlers = [file]
   log.file.handlers = [emqx_subscription]
   

3. Analyze logs for patterns of unauthorized access:

   grep "SUBSCRIBE" /var/log/emqx/emqx_subscription.log | grep -E "(#|\+)" | grep -v "admin"
   

4. Set up alerts for multiple subscription attempts from the same user to different wildcard topics.
5. Use network monitoring to detect MQTT traffic on port 1883/8883 and flag unusual subscription patterns.

Mitigation Steps:

1. Restrict wildcard subscriptions to only trusted users (e.g., admin accounts).
2. Implement custom ACLs in EMQX to deny wildcard subscriptions for low-privilege users:

   %% In acl.conf or similar
   {allow, {user, "attacker"}, subscribe, ["$SYS/#", "#"]}.
   {deny, all, subscribe, ["#"]}.
   

3. Upgrade to EMQX 5.x if possible, as it includes improved authorization mechanisms.
4. Use TLS to encrypt MQTT traffic and prevent eavesdropping.

Indicators of Compromise (IOCs)

• Network IOCs:

  • MQTT subscription requests to wildcard topics (#, +) from low-privilege users.
  • Unusual volume of MQTT messages being received by a single client.
  • Connections to MQTT broker from IP addresses not associated with legitimate devices.

• Log IOCs:

  • Repeated SUBSCRIBE requests with wildcard topics in EMQX logs.
  • Authentication logs showing low-privilege users subscribing to global topics.
  • Alerts from IDS/IPS systems detecting MQTT wildcard subscription attempts.

• File IOCs:

  • Large log files containing MQTT telemetry data on attacker-controlled systems.
  • Scripts or tools used for MQTT subscription (e.g., mosquitto_sub, paho-mqtt).

Detection Engineering

YARA Rule

rule MQTT_Wildcard_Subscription_Attempt {
    meta:
        description = "Detects MQTT subscription requests with wildcard topics"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-33356"
    strings:
        $wildcard1 = "#" ascii wide
        $wildcard2 = "+" ascii wide
        $mqtt_sub = "SUBSCRIBE" ascii wide
    condition:
        $mqtt_sub and ($wildcard1 or $wildcard2)
}

Sigma Rule

title: MQTT Wildcard Subscription Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects MQTT subscription requests with wildcard topics from low-privilege users
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33356
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: emqx
detection:
    selection:
        EventID: "SUBSCRIBE"
        Topic|contains|any:
            - "#"
            - "+"
        Username|contains: "attacker"
    condition: selection
falsepositives:
    - Legitimate admin users performing maintenance
level: high

Suricata Rule

alert tcp any any -> any 1883 (msg:"MQTT Wildcard Subscription Attempt"; flow:to_server; content:"|10|"; depth:1; content:"|82|"; within:1; content:"#"; distance:2; within:1; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict wildcard subscriptions to only trusted users by implementing custom ACLs in EMQX.
2. Monitor logs for unauthorized subscription attempts and block offending IPs.
3. Use network segmentation to isolate MQTT brokers from untrusted networks.

Long-term Fixes:

1. Upgrade to EMQX 5.x which includes per-device authorization for subscriptions.
2. Implement a custom authorization plugin that checks device ownership before allowing subscriptions.
3. Apply the conceptual patch described in the Vulnerable vs. Patched Code section if you have access to the EMQX source code.

Workarounds:

• Disable wildcard subscriptions entirely if not required for business operations.
• Use topic-based access control with fine-grained ACLs for each device.
• Implement MQTT over TLS with client certificates to ensure only authorized devices can connect.

Valters IT