CVE-2026-33356

{
  "id": "CVE-2026-33356",
  "sourceIdentifier": "44488dab-36db-4358-99f9-bc116477f914",
  "published": "2026-05-11T17:16:30.590",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope."
    },
    {
      "lang": "es",
      "value": "En las implementaciones de Meari IoT Cloud MQTT Broker que ejecutan EMQX 4.x, cualquier cuenta autenticada de bajo privilegio puede suscribirse a temas comodín globales y recibir telemetría de dispositivos que el usuario no posee. El broker aplica restricciones de publicación, pero no aplica una autorización de suscripción equivalente a nivel de dispositivo."
    }
  ],
  "affected": [
    {
      "source": "44488dab-36db-4358-99f9-bc116477f914",
      "affectedData": [
        {
          "vendor": "Meari",
          "product": "IoT Cloud MQTT Broker EMQX",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.x",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "44488dab-36db-4358-99f9-bc116477f914",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T18:18:36.704517Z",
          "id": "CVE-2026-33356",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "44488dab-36db-4358-99f9-bc116477f914",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/xn0tsa/nobody-puts-baby-in-a-corner",
      "source": "44488dab-36db-4358-99f9-bc116477f914"
    },
    {
      "url": "https://www.runzero.com/advisories/meari-mqtt-broker-missing-per-device-subscribe-acl-cve-2026-33356/",
      "source": "44488dab-36db-4358-99f9-bc116477f914"
    }
  ]
}