CVE-2026-79391: Trueview MQTT Auth Bypass Vulnerability

CVE-2026-79391 Overview

CVE-2026-79391 is a missing authentication vulnerability in the Message Queuing Telemetry Transport (MQTT) service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requiring credentials. A remote attacker with network access to the broker can establish an MQTT session and perform unauthorized publish or subscribe operations. The flaw is classified under [CWE-306] Missing Authentication for Critical Function. Successful exploitation exposes device telemetry, allows injection of forged messages, and can disrupt downstream automation logic that trusts broker data.

Critical Impact
An unauthenticated remote attacker can subscribe to all MQTT topics or publish arbitrary messages, compromising confidentiality, integrity, and availability of Trueview 6.0.23.4 deployments.

Affected Products

Trueview 6.0.23.4
MQTT broker service listening on TCP port 1883
Downstream systems consuming Trueview MQTT topics

Discovery Timeline

2026-09-04 - CVE-2026-79391 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-11 - Exploit Prediction Scoring System (EPSS) data published

Technical Details for CVE-2026-79391

Vulnerability Analysis

The Trueview 6.0.23.4 MQTT broker exposes TCP port 1883 without enforcing client authentication. MQTT is a publish/subscribe messaging protocol widely used in Internet of Things (IoT) and video management deployments. When a broker omits authentication, any host that can reach port 1883 becomes an implicit trusted participant in the messaging fabric.

An attacker that connects with an arbitrary client identifier can enumerate topics via wildcard subscriptions such as # and $SYS/#. The attacker can also publish crafted messages to any topic, including command channels consumed by connected devices or services. This grants the ability to exfiltrate telemetry, forge commands, and disrupt operational workflows without prior access.

Root Cause

The root cause is an insecure default configuration in the MQTT broker packaged with Trueview 6.0.23.4. The broker is deployed with allow_anonymous behavior enabled and no Access Control List (ACL) enforcement. No username, password, client certificate, or Transport Layer Security (TLS) handshake is required to complete a CONNECT packet exchange.

Attack Vector

Exploitation requires only network reachability to TCP port 1883. No credentials, user interaction, or elevated privileges are needed. The attack can be executed from any host on the same network segment or from the internet if the broker is exposed. Refer to the GitHub PoC Repository for CVE-2026-79391 for the published proof-of-concept methodology.

A typical attack flow involves connecting a standard MQTT client to port 1883, subscribing to the wildcard topic # to capture all broker traffic, then publishing forged control messages to observed topics. No exploitation code is reproduced here; consult the referenced advisory for technical detail.

Detection Methods for CVE-2026-79391

Indicators of Compromise

Unexpected MQTT CONNECT packets on TCP port 1883 originating from unfamiliar source addresses or client identifiers.
Wildcard subscriptions to topics such as # or $SYS/# from clients that are not part of the sanctioned Trueview deployment.
Anomalous PUBLISH messages on control topics that do not correlate with legitimate device activity.

Detection Strategies

Perform network scans to identify Trueview hosts exposing TCP port 1883 without TLS or authentication banners.
Enable broker-side logging of CONNECT, SUBSCRIBE, and PUBLISH events and alert on unauthenticated sessions.
Baseline expected client identifiers and topic patterns, then flag deviations for review.

Monitoring Recommendations

Forward MQTT broker logs and network flow data to a centralized analytics platform for correlation.
Monitor for outbound MQTT traffic from Trueview hosts to unexpected destinations, indicating attacker-controlled brokers.
Track subscription counts and message rates per client to detect enumeration and flooding behaviors.

How to Mitigate CVE-2026-79391

Immediate Actions Required

Restrict TCP port 1883 access to trusted management subnets using firewall or network segmentation controls.
Disable anonymous access on the MQTT broker and require username and password authentication for all clients.
Audit existing MQTT client connections and revoke any sessions that cannot be attributed to sanctioned devices.

Patch Information

No vendor patch information is available in the referenced advisory at the time of publication. Consult the GitHub PoC Repository for CVE-2026-79391 and the Trueview vendor for remediation guidance and updated firmware or configuration releases.

Workarounds

Deploy MQTT over TLS on TCP port 8883 with client certificate authentication where the broker supports it.
Enforce Access Control List (ACL) rules that restrict publish and subscribe permissions per client identifier.
Place the broker behind a Virtual Private Network (VPN) or zero-trust network gateway to prevent direct exposure.

bash

# Configuration example: harden a Mosquitto-compatible MQTT broker
listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate true
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/aclfile