The vulnerability originates from an overly permissive AWS IoT policy attached to the iSteamX mobile application. Authenticated users can subscribe to or publish on wildcard MQTT topics, which enables them to read data from other users and control connected devices. This opens a path for both information disclosure—exposing user profile details and device telemetry—and operational abuse, such as triggering unintended device actions that could result in physical harm, exemplified by potential scalding from inadvertent activation. The flaw falls under CWE-653, indicating reliance on insufficient separation of user contexts.

This issue affects all instances of the MrSteam iSteamX Hub and the iSteamX mobile application that were released prior to the vendor’s security update on September 18, 2026. No specific version numbers are listed, so any deployment using the original MQTT policy configuration before the update is potentially impacted.

The vulnerability carries a CVSS v3 score of 8.4, classifying it as high severity, and is not currently catalogued in the CISA KEV list. Because the exploit requires authenticated access, an attacker already possessing valid user credentials could readily leverage the wildcard topics. While no EPSS score is available, the high base score and the operational nature of the impact suggest a non-negligible risk of exploitation, especially in environments where device ownership data is sensitive or where stray device controls could pose safety hazards.