CVE-2026-79389 Details
Description
Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.
A vulnerability exists in the Trueview T18161 S Security Camera running firmware 6.0.23.4, due to improper verification of MQTT messages. This flaw allows an attacker with network access to replay or modify intercepted MQTT messages, including critical fields such as nonce, timestamp, and signature. The camera accepts these altered messages and executes the corresponding commands, undermining the integrity and authenticity of the MQTT command processing.
To address this vulnerability, it is recommended to implement proper cryptographic validation of the signature on every MQTT command, ensuring that any modifications to a signed message cause the verification to fail. Additionally, nonces should be generated securely and be unique, while timestamps must be validated to ensure they are current. Using MQTT over TLS can also help protect against interception of commands.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2026-79389 | [email protected] | Technical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Trueview T18161 S | 6.0.23.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |