{"id":"CVE-2026-95699","published":"2026-09-24T21:18:58.613","lastModified":"2026-09-25T17:17:20.097","description":"Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","cwes":["CWE-653"],"vendors":[],"products":[],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json","tags":[]},{"url":"https://www.mrsteam.com/contactus/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The iSteamX mobile application's AWS policy flaw allows authenticated users to access wildcard MQTT topics, exposing other users' device data and potentially scalding due to unintended device activation.","exploitability":"Exploitation requires authenticated access to the iSteamX application and knowledge of the affected AWS policy configuration.","blast_radius":"If exploited, this could lead to unauthorized access to multiple users' device data and potential physical harm due to device activation.","remediation":"Upgrade to the latest version of the iSteamX application, which addresses the AWS policy issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","data-exposure","iot"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:49:00.213Z"}}