An improper check in the MQTT command processing pathway, which constitutes CWE‑347 Replay Protection Failure, allows an attacker with network access to replay or alter captured MQTT packets, including fields such as nonce, timestamp and signature. Because the device accepts these modified messages it executes the attached commands, effectively providing remote command execution on the target device.

The flaw is present in Trueview T18161 S firmware version 6.0.23.4. No other vendors or products are listed as affected.

The vulnerability can be leveraged from any host that can sniff the MQTT traffic on the network, making the attack vector local or corporate. With a CVSS score of 7.4, the severity of the vulnerability is high. The absence of proper authentication or replay protection means that the exploitation conditions are minimal and the impact is severe, as arbitrary commands are executed on the device. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential for widespread damage warrants close monitoring and immediate patching.