CVE-2025-0681: Cloud MQTT Wildcard Information Disclosure

CVE-2025-0681 Overview

CVE-2025-0681 is an information disclosure vulnerability affecting the Cloud MQTT service used by NewRock Technologies products. The service permits wildcard topic subscriptions, allowing an attacker with access to the MQTT broker to intercept messages exchanged across unrelated topics. This exposes sensitive operational data flowing between devices and the cloud service. The issue is tracked under CISA ICS Advisory ICSA-25-030-02 and is categorized as an improper neutralization of wildcards weakness [CWE-155].

Critical Impact
An attacker subscribing with a wildcard topic filter can passively capture communications intended for other clients, resulting in disclosure of sensitive information transmitted through the MQTT broker.

Affected Products

NewRock Technologies Cloud MQTT service
Devices and endpoints publishing to the affected Cloud MQTT broker
Downstream integrations consuming telemetry from the affected service

Discovery Timeline

2025-01-30 - CVE-2025-0681 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0681

Vulnerability Analysis

Message Queuing Telemetry Transport (MQTT) is a publish/subscribe protocol widely used in Internet of Things (IoT) and industrial deployments. Subscribers register interest in topics, and the broker forwards matching published messages. MQTT supports two wildcards in subscription filters: + for a single topic level and # for multiple levels.

The affected Cloud MQTT service accepts wildcard subscriptions without adequate access control on topic scope. An authenticated or otherwise permitted client can subscribe to # or high-level wildcard filters and receive traffic addressed to other tenants or devices. Because MQTT payloads frequently contain device identifiers, configuration data, credentials, and telemetry, the exposure is direct and passive.

The weakness is classified as [CWE-155] Improper Neutralization of Wildcards or Matching Symbols. Refer to the CISA ICS Advisory ICSA-25-030-02 for the authoritative vendor-coordinated details.

Root Cause

The root cause is missing topic-level authorization on the broker. The service does not restrict wildcard subscriptions to topics the subscribing client is entitled to read. As a result, wildcard matching returns messages across tenant or device boundaries that should remain isolated.

Attack Vector

The attack requires local access to the MQTT service as described in the CVSS metrics. An attacker who can reach the broker submits a subscription such as # or sensors/+/data and passively receives forwarded messages. No user interaction is required, and the attacker does not need to publish or modify any data to obtain the information.

No verified public proof-of-concept code is available for this issue. See the CISA ICS Advisory ICSA-25-030-02 for coordinated technical guidance.

Detection Methods for CVE-2025-0681

Indicators of Compromise

MQTT SUBSCRIBE packets containing broad wildcard filters such as #, +/#, or $SYS/# originating from unexpected clients.
Unusually long-lived MQTT sessions from a single client ID receiving traffic across many topic hierarchies.
Broker logs showing subscription counts or message delivery volumes that deviate significantly from a client's historical baseline.

Detection Strategies

Enable verbose broker logging for CONNECT, SUBSCRIBE, and UNSUBSCRIBE events and alert on wildcard subscriptions outside an approved allowlist.
Inspect network flows on TCP 1883 and 8883 to profile subscription behavior per client and flag anomalies.
Correlate authentication events with topic access patterns to identify clients reading topics they do not publish to.

Monitoring Recommendations

Baseline the legitimate set of topic filters per client identifier and alert on new wildcard usage.
Forward broker access logs to a centralized analytics platform for retention and cross-source correlation.
Monitor for outbound data transfers from hosts that connect to the MQTT broker to detect potential exfiltration of captured messages.

How to Mitigate CVE-2025-0681

Immediate Actions Required

Contact NewRock Technologies through the NewRockTech Contact Page to obtain vendor guidance and remediation status.
Restrict network exposure of the Cloud MQTT service to trusted management networks only.
Audit existing MQTT clients and revoke credentials that are not strictly required for operations.

Patch Information

Refer to the CISA ICS Advisory ICSA-25-030-02 for the current vendor remediation status. Coordinate directly with NewRock Technologies to obtain updated firmware or cloud service configuration changes that enforce per-client topic authorization.

Workarounds

Configure broker access control lists (ACLs) to prohibit wildcard subscriptions or scope them to a client's authorized topic namespace.
Enforce mutual TLS authentication on port 8883 and issue unique client certificates so ACLs can bind to identity.
Segment IoT devices and management systems into isolated networks and block direct client-to-broker paths from untrusted zones.
Encrypt sensitive payloads at the application layer so intercepted messages cannot be read in plaintext.

bash

# Example Mosquitto ACL restricting a client to its own topic subtree
# /etc/mosquitto/acl.conf
user device-1234
topic readwrite devices/1234/#

# Deny wildcard subscription attempts outside the assigned subtree
pattern read devices/%c/#