CloudEdge Cloud CVE-2025-11757

Exploitation requires the attacker to reach and subscribe on the CloudEdge cloud MQTT broker and to supply a topic string containing an MQTT wildcard ('#' or '+'); the root condition is the backend's failure to sanitize/scope the MQTT topic input per user, allowing cross-tenant message reception. The payoff is specific: messages carry camera credentials and peer-to-peer connection keys for other users' cameras. Limiting factors: although the CVSS vector lists PR:N, connecting to the broker realistically presupposes the ability to establish an authenticated MQTT session to the CloudEdge cloud, and exploitation is confined to confidentiality (no integrity/availability impact); the condition is tied to the cloud service itself, not a per-device or non-default local setting.

Signals are mixed and lean toward a moderate-but-real data-exposure risk rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack needing no user interaction, and the VC:H impact reflects the serious confidentiality consequence: harvesting other users' camera credentials and peer-to-peer connection keys. However, EPSS is low (0.32%, 23rd percentile), there is no CISA KEV listing and no public exploit identified, indicating no evidence of widespread opportunistic exploitation. The reporting path (ICS-CERT / CISA ICS advisory) and CWE-155 (improper wildcard neutralization) are consistent with the MQTT topic-injection description, so the core finding is coherent. One point to verify: the vector states PR:N (unauthenticated), yet connecting to and subscribing on the CloudEdge MQTT broker realistically requires a valid service account - the practical barrier may be a low-privilege account rather than true anonymity, which would modestly raise attack complexity in the real world. Net: a credible privacy/credential-disclosure flaw affecting a consumer camera ecosystem, worth prioritizing for users of this product, but not a mass-exploitation 'patch-tonight' event based on current exploitation signals.

An attacker who can connect to the CloudEdge cloud MQTT broker subscribes to a topic using an unsanitized MQTT wildcard (e.g., '#') instead of their own device topic. Because the backend does not restrict topic scope per user, the broker streams messages intended for other customers, including camera credentials and P2P keys, letting the attacker enumerate and connect directly to victims' cameras. No public exploit code has been identified, so this reflects the described mechanism rather than a confirmed released PoC.