CVE-2026-79389 Overview
CVE-2026-79389 affects Trueview T18161 S firmware version 6.0.23.4. The device performs improper verification of Message Queuing Telemetry Transport (MQTT) command messages. Security-related fields including nonce, timestamp, and signature values are not validated correctly. An attacker with network access can replay captured MQTT traffic or tamper with message contents. The device accepts the modified messages and executes the embedded commands.
Critical Impact
Network-adjacent attackers can replay or forge MQTT commands to control affected Trueview T18161 S devices without valid authentication material.
Affected Products
- Trueview T18161 S firmware version 6.0.23.4
Discovery Timeline
- 2026-09-04 - CVE-2026-79389 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Record last modified in NVD
Technical Details for CVE-2026-79389
Vulnerability Analysis
The Trueview T18161 S device exposes command functionality over MQTT, a lightweight publish-subscribe protocol commonly used in Internet of Things (IoT) deployments. The firmware includes nonce, timestamp, and signature fields inside MQTT command payloads, suggesting an intended replay- and integrity-protection scheme. The verification logic does not enforce these fields correctly.
An attacker positioned on the network path or on the same broker can capture legitimate MQTT command messages. The attacker can then replay the messages unchanged or modify the payload, including the security fields themselves. The device processes the tampered messages and executes the associated commands. This behavior maps to improper verification of cryptographic signatures and insufficient replay protection, categories tracked under CWE-347 and CWE-294.
Root Cause
The firmware does not correctly validate the cryptographic binding between the security fields and the command payload. Modifications to the nonce, timestamp, or signature do not cause the device to reject the message. Replay caches or monotonic timestamp checks are either absent or ineffective. This allows both replay and tamper-and-resend attack patterns against the MQTT command interface.
Attack Vector
Exploitation requires network access to the MQTT traffic path between publisher and device, or to the broker itself. An attacker captures a legitimate command frame using a network sniffer or a subscribed client on the relevant topic. The attacker republishes the frame verbatim to replay a prior command, or edits payload fields and resubmits the message. The device executes the resulting command as if it originated from an authorized publisher.
No verified proof-of-concept code is published in the enriched dataset. See the GitHub PoC Repository for CVE-2026-79389 for technical artifacts released by the reporter.
Detection Methods for CVE-2026-79389
Indicators of Compromise
- Duplicate MQTT PUBLISH frames on device command topics containing identical payloads, nonces, or timestamps observed across widely separated time windows.
- Command execution events on the device that do not correlate to a legitimate operator action or scheduled automation run.
- MQTT client connections to the broker from unexpected source addresses or client identifiers on command topics.
Detection Strategies
- Enable MQTT broker access and publish logging, then baseline expected publishers, client IDs, and topic patterns for the Trueview T18161 S fleet.
- Alert on repeated MQTT payloads carrying the same nonce or timestamp value, which indicates replay activity against the vulnerable verification logic.
- Correlate broker publish events with device-side command execution logs to surface commands that lack a matching authorized publisher.
Monitoring Recommendations
- Forward MQTT broker logs and device syslog into a centralized analytics platform for cross-source correlation and retention.
- Monitor for anomalous connection sources on TCP ports 1883 and 8883, and any unauthorized subscribers on device command topics.
- Track configuration or state changes on affected devices and require attribution to a known operator or automation identity.
How to Mitigate CVE-2026-79389
Immediate Actions Required
- Restrict network reachability to the MQTT broker and Trueview T18161 S devices using segmentation, firewall rules, and allowlists for publisher clients.
- Enforce TLS on all MQTT connections and require per-client certificate or strong credential authentication at the broker.
- Apply broker-side Access Control Lists (ACLs) so only authorized client IDs can publish to device command topics.
- Contact the vendor for a firmware update addressing the MQTT command verification flaw in version 6.0.23.4.
Patch Information
No vendor advisory or fixed firmware version is listed in the available CVE record. Operators of Trueview T18161 S devices running firmware 6.0.23.4 should engage the vendor directly to confirm remediation status and obtain updated firmware when available. Reference material is published in the GitHub PoC Repository for CVE-2026-79389.
Workarounds
- Place affected devices on an isolated management VLAN with no direct exposure to untrusted networks or the public internet.
- Terminate MQTT sessions through a broker that enforces TLS, mutual authentication, and per-topic ACLs to constrain who can publish commands.
- Deploy a network sensor on the MQTT segment to detect duplicate or tampered publish frames while a vendor patch is pending.
# Configuration example: Mosquitto broker hardening for MQTT command topics
listener 8883
protocol mqtt
cafile /etc/mosquitto/ca.crt
certfile /etc/mosquitto/server.crt
keyfile /etc/mosquitto/server.key
require_certificate true
use_identity_as_username true
allow_anonymous false
acl_file /etc/mosquitto/acl
# /etc/mosquitto/acl
user trueview-operator
topic write devices/trueview/+/cmd
topic read devices/trueview/+/state
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
