CVE-2026-79390: Trueview TI8161 Information Disclosure

CVE-2026-79390 Overview

CVE-2026-79390 is an information disclosure vulnerability in Trueview TI8161 version 6.0.23.4. The device transmits Message Queuing Telemetry Transport (MQTT) communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and read device identifiers, message metadata, and control-related information. The weakness is categorized under [CWE-284: Improper Access Control]. Passive network capture is sufficient for exploitation, requiring no credentials or user interaction.

Critical Impact
Any adversary on the local network segment can silently harvest sensitive device telemetry and control data by capturing unencrypted MQTT broker traffic.

Affected Products

Trueview TI8161 firmware version 6.0.23.4
Deployments exposing MQTT broker on TCP port 1883
Network segments where the device shares Layer 2 access with untrusted hosts

Discovery Timeline

2026-09-04 - CVE-2026-79390 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79390

Vulnerability Analysis

The Trueview TI8161 device operates an MQTT client or broker that communicates over the default unencrypted MQTT port 1883. MQTT is a lightweight publish-subscribe protocol commonly used by Internet of Things (IoT) devices for telemetry and control messaging. The protocol supports Transport Layer Security (TLS) on port 8883, but the affected firmware does not enable transport encryption. As a result, all MQTT CONNECT, PUBLISH, and SUBSCRIBE packets traverse the network as cleartext. An attacker who can observe traffic — through a switch span port, network tap, ARP spoofing, or a compromised adjacent host — recovers the full contents of MQTT payloads. Disclosed data includes device identifiers, topic names, timestamps, and control-plane messages that describe the device's operational state.

Root Cause

The root cause is the absence of transport encryption and authentication controls on the MQTT channel. The device relies on the default plaintext MQTT configuration and does not enforce TLS or client certificate validation. This is a design-level configuration flaw ([CWE-284]) rather than a memory safety issue.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An adversary positioned on the same broadcast domain, VLAN, or upstream path passively captures traffic destined for TCP port 1883. Standard packet capture tooling such as tcpdump or Wireshark, combined with an MQTT dissector, reconstructs the topic hierarchy and message payloads. See the GitHub CVE PoC Repository for technical details on the disclosure and observed traffic samples.

Detection Methods for CVE-2026-79390

Indicators of Compromise

Unencrypted MQTT sessions observed on TCP port 1883 originating from or terminating at TI8161 devices
Unexpected hosts on the local segment establishing subscriptions to broker topics
ARP table anomalies or duplicate MAC addresses indicating a man-in-the-middle position adjacent to affected devices

Detection Strategies

Deploy network sensors that flag cleartext MQTT (CONNECT, SUBSCRIBE, PUBLISH) packets on port 1883 in production segments
Baseline authorized MQTT clients by IP and MAC address, then alert on new subscribers to device topics
Correlate switch port and DHCP logs to identify unauthorized hosts placed on IoT VLANs

Monitoring Recommendations

Forward NetFlow or IPFIX records for port 1883 to a central analytics platform and review for out-of-policy talkers
Enable ARP inspection and DHCP snooping on switches supporting the IoT segment to detect spoofing attempts
Retain full packet capture on IoT VLAN uplinks for retrospective analysis of MQTT sessions

How to Mitigate CVE-2026-79390

Immediate Actions Required

Isolate Trueview TI8161 devices on a dedicated VLAN with strict Access Control Lists (ACLs) that permit only authorized MQTT brokers and clients
Block ingress and egress of TCP port 1883 at network boundaries so plaintext MQTT cannot traverse untrusted paths
Inventory all TI8161 devices running firmware 6.0.23.4 and prioritize them for remediation

Patch Information

No vendor advisory or fixed firmware version is referenced in the NVD entry at the time of publication. Monitor the vendor's support channels for a firmware release that enables MQTT over TLS on port 8883 and enforces client authentication. Consult the GitHub CVE PoC Repository for ongoing disclosure updates.

Workarounds

Terminate MQTT traffic at a hardened broker that proxies to the device over an isolated, physically protected link
Tunnel MQTT sessions through an IPsec or WireGuard overlay when TLS cannot be enabled on the device itself
Enforce port security, 802.1X, and Private VLANs to prevent unauthorized hosts from joining the IoT segment

bash

# Configuration example: block plaintext MQTT at the perimeter and permit only TLS MQTT
iptables -A FORWARD -p tcp --dport 1883 -j DROP
iptables -A FORWARD -p tcp --dport 8883 -s 10.10.20.0/24 -d 10.10.30.10 -j ACCEPT