CVE-2026-22535 HIGH

CVE-2026-22535: FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS

Vendor Efacec
Product QC 60/90/120
Weakness CWE-1366
Published January 7, 2026
Last update January 7, 2026
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Adjacent
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications

Key dates

02Disclosure timeline

January 7, 2026 CVE published
January 7, 2026 Record updated