MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized device impersonation and disruption of messaging
functions.
Ebyte acknowledged receipt of the reported vulnerabilities and indicated
that a patch was under development. However, the vendor has not
responded to subsequent requests for coordination, and CISA has not been
informed of the status or availability of the patch. Users are
encouraged to reach out to Ebyte for more information.