Anviz CX7 Firmware MQTT Traffic Decryption Vulnerability

A vulnerability exists in Anviz CX7 Firmware due to the inclusion of reusable certificate and key material within the application. This flaw allows for the decryption of MQTT traffic, potentially enabling unauthorized interaction with device messaging channels on a large scale.

Impact

Exploitation of this vulnerability could lead to unauthorized decryption of MQTT traffic, allowing attackers to intercept and manipulate communications with the device.

Remediation

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information.