Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-95699 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.6 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CNA: [email protected]CVSS-B:9.6 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json	[email protected]	AdvisoryRemedy
https://www.mrsteam.com/contactus/	[email protected]	Vendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-653	Improper Isolation or Compartmentalization	[email protected]

Affected Products

Product	Versions
MrSteam iSteamX	v1.3.42_(build_44)
CPE No CPEs found in CPE dictionary for this product. Remediation Workaround:moderate efforthttps://www.mrsteam.com/contactus/ Contact MrSteam for more information regarding the countermeasures implemented on 9/18/2026.
MrSteam iSteamX Hub	v4.2.1 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Workaround:moderate efforthttps://www.mrsteam.com/contactus/ Contact MrSteam for more information regarding the countermeasures implemented on 9/18/2026.

Change History

1 change record found show changes