CVE-2025-11757: CloudEdge Cloud Information Disclosure

CVE-2025-11757 Overview

CVE-2025-11757 is an input validation vulnerability in the CloudEdge Cloud service. The platform fails to sanitize Message Queuing Telemetry Transport (MQTT) topic input supplied by clients. An attacker can abuse MQTT wildcard characters to subscribe to topics belonging to other users. This subscription returns broker traffic intended for other tenants, including credentials and key material used to establish peer-to-peer connections to cameras. The flaw is tracked under CWE-155: Improper Neutralization of Wildcards or Matching Symbols. CISA published the issue in ICS Advisory ICSA-25-294-05.

Critical Impact
An unauthenticated remote attacker can harvest camera credentials and peer-to-peer connection keys belonging to other CloudEdge users by subscribing to wildcard MQTT topics.

Affected Products

CloudEdge Cloud service (MQTT broker component)
IP camera fleets provisioned through the CloudEdge platform
Mobile and web clients relying on the CloudEdge MQTT backend

Discovery Timeline

2025-10-21 - CVE-2025-11757 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11757

Vulnerability Analysis

The CloudEdge Cloud broker accepts MQTT SUBSCRIBE requests without filtering wildcard characters from the topic filter string. MQTT defines two wildcards in topic filters: the single-level wildcard + and the multi-level wildcard #. When a broker enforces no per-tenant access control list (ACL) on topic filters, subscribing to a filter such as # or devices/# matches topics owned by every tenant. The broker then forwards all matching publish messages to the subscribing client. In the CloudEdge case, those messages carry sensitive provisioning data, including credentials and keys used to negotiate peer-to-peer (P2P) camera streams. An attacker who captures these values can connect directly to victim cameras outside the cloud path. The exploit requires only a valid MQTT session against the broker and no privileges on the targeted tenants.

Root Cause

The root cause is missing neutralization of MQTT wildcard characters combined with absent topic-level authorization. The broker treats wildcard subscriptions as legitimate without verifying that the requesting client owns the matched topic namespace. CWE-155 captures this class of defect.

Attack Vector

The attack vector is network based. An attacker establishes an MQTT connection to the CloudEdge broker and issues a SUBSCRIBE with a wildcard topic filter. The broker streams messages from other tenants, exposing camera credentials and P2P keys. Code-level exploitation details are not published. Refer to CISA ICS Advisory ICSA-25-294-05 for vendor coordination details.

Detection Methods for CVE-2025-11757

Indicators of Compromise

MQTT SUBSCRIBE packets containing # or + wildcards at or near the root of the topic hierarchy.
Single MQTT client identifiers receiving message volumes that exceed the number of devices registered to that account.
Outbound P2P connection attempts to cameras from IP addresses not previously associated with the owning account.

Detection Strategies

Inspect broker logs for subscription requests whose topic filter contains wildcards above the per-tenant prefix.
Correlate MQTT session identifiers with account ownership and alert on cross-tenant topic matches.
Baseline normal message throughput per client and flag statistical outliers consistent with bulk message harvesting.

Monitoring Recommendations

Forward MQTT broker access and authorization logs into a centralized analytics pipeline for retention and review.
Monitor for credential reuse where camera credentials observed in MQTT traffic later authenticate from new networks.
Track P2P signaling endpoints for unexpected client geolocations or unusual connection cadence.

How to Mitigate CVE-2025-11757

Immediate Actions Required

Apply vendor updates referenced in CISA ICS Advisory ICSA-25-294-05 as soon as they are available for your CloudEdge deployment.
Rotate camera credentials and P2P keys for any account that connected to the CloudEdge cloud prior to remediation.
Restrict outbound MQTT traffic from sensitive networks to the vendor broker until the fix is confirmed.

Patch Information

Remediation is coordinated through the CloudEdge vendor and CISA. Consult CISA ICS Advisory ICSA-25-294-05 for the current patch status, fixed firmware or cloud service versions, and vendor contact information. No fixed product versions are listed in the NVD record at the time of publication.

Workarounds

Where deployment allows, place CloudEdge cameras behind a network segment that blocks direct P2P inbound flows from untrusted sources.
Disable remote viewing features that depend on the affected MQTT broker until vendor mitigations are in place.
Require strong, unique credentials per camera so that disclosed values cannot be reused across devices.

bash

# Example: block outbound MQTT (TCP 8883/1883) from a camera VLAN at the firewall
# Replace interface and subnet values to match your environment
iptables -A FORWARD -i vlan-cameras -p tcp --dport 1883 -j DROP
iptables -A FORWARD -i vlan-cameras -p tcp --dport 8883 -j DROP