CVE-2026-95699

9.6 CRITICAL

Published 2026-09-24 · Updated 2026-09-25

AI risk analysis

Summary: The iSteamX mobile application's AWS policy flaw allows authenticated users to access wildcard MQTT topics, exposing other users' device data and potentially scalding due to unintended device activation.
Exploitability: Exploitation requires authenticated access to the iSteamX application and knowledge of the affected AWS policy configuration.
Blast radius: If exploited, this could lead to unauthorized access to multiple users' device data and potential physical harm due to device activation.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the latest version of the iSteamX application, which addresses the AWS policy issue.

auth-bypassdata-exposureiot

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

Weaknesses

CWE-653

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.