CVE-2026-95699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95699", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-09-22T14:36:39.739Z", "datePublished": "2026-09-24T20:39:59.975Z", "dateUpdated": "2026-09-25T16:16:48.362Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-09-24T20:39:59.975Z"}, "title": "MrSteam iSteamX Improper Isolation or Compartmentalization", "datePublic": "2026-09-24T16:17:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-653", "description": "CWE-653 Improper isolation or compartmentalization", "type": "CWE"}]}], "affected": [{"vendor": "MrSteam", "product": "iSteamX application", "versions": [{"status": "affected", "version": "v1.3.42 (build 44)"}], "defaultStatus": "unaffected"}, {"vendor": "MrSteam", "product": "iSteamX Hub", "versions": [{"status": "affected", "version": "v4.2.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div>Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.</div></div>"}]}], "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json"}, {"url": "https://www.mrsteam.com/contactus/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"}}], "solutions": [{"lang": "en", "value": "The vendor has implemented countermeasures to mitigate this vulnerability and is in effect as of 9/18/2026. Affected users are encouraged to contact them for more information at ( https://www.mrsteam.com/contactus/ ).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>The vendor has implemented countermeasures to mitigate this vulnerability and is in effect as of 9/18/2026. Affected users are encouraged to contact them for more information at (<span><a href=\"https://www.mrsteam.com/contactus/\">https://www.mrsteam.com/contactus/</a>)</span><span>.</span></div>"}]}], "credits": [{"lang": "en", "value": "Darren Challis", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T16:16:01.270470Z", "id": "CVE-2026-95699", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T16:16:48.362Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-95699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T16:16:01.270470Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T16:16:21.835Z"}}], "cna": {"title": "MrSteam iSteamX Improper Isolation or Compartmentalization", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Darren Challis"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MrSteam", "product": "iSteamX application", "versions": [{"status": "affected", "version": "v1.3.42 (build 44)"}], "defaultStatus": "unaffected"}, {"vendor": "MrSteam", "product": "iSteamX Hub", "versions": [{"status": "affected", "version": "v4.2.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vendor has implemented countermeasures to mitigate this vulnerability and is in effect as of 9/18/2026. Affected users are encouraged to contact them for more information at ( https://www.mrsteam.com/contactus/ ).", "supportingMedia": [{"type": "text/html", "value": "<div>The vendor has implemented countermeasures to mitigate this vulnerability and is in effect as of 9/18/2026. Affected users are encouraged to contact them for more information at (<span><a href=\"https://www.mrsteam.com/contactus/\">https://www.mrsteam.com/contactus/</a>)</span><span>.</span></div>", "base64": false}]}], "datePublic": "2026-09-24T16:17:00.000Z", "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json"}, {"url": "https://www.mrsteam.com/contactus/"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-653", "description": "CWE-653 Improper isolation or compartmentalization"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-09-24T20:39:59.975Z"}}}, "cveMetadata": {"cveId": "CVE-2026-95699", "state": "PUBLISHED", "dateUpdated": "2026-09-25T16:16:48.362Z", "dateReserved": "2026-09-22T14:36:39.739Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-09-24T20:39:59.975Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "iSteamX application", "vendor": "MrSteam", "versions": [{"status": "affected", "version": "v1.3.42 (build 44)"}]}, {"defaultStatus": "unaffected", "product": "iSteamX Hub", "vendor": "MrSteam", "versions": [{"status": "affected", "version": "v4.2.1"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation."}], "id": "CVE-2026-95699", "lastModified": "2026-09-25T17:17:20.097", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95699", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T16:16:01.270470Z", "version": "2.0.3"}}]}, "published": "2026-09-24T21:18:58.613", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.mrsteam.com/contactus/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-653"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.3.42 (build 44)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "iSteamX application", "source": "cna", "vendor": "MrSteam"}, "product": "isteamx_application", "vendor": "mrsteam"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v4.2.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "iSteamX Hub", "source": "cna", "vendor": "MrSteam"}, "product": "isteamx_hub", "vendor": "mrsteam"}], "created": "2026-09-25T03:15:14.384339+00:00", "updated": "2026-09-25T14:14:53.042480+00:00", "vendors": ["mrsteam", "mrsteam$PRODUCT$isteamx_application", "mrsteam$PRODUCT$isteamx_hub"]}