Trueview CVE-2026-79391

The single required condition is network reachability to the Trueview 6.0.23.4 MQTT broker on TCP port 1883 - no credentials, user interaction, or non-default configuration are needed, since the broker accepts anonymous connections by design. Exploitation is limited only by network exposure: an instance whose port 1883 is firewalled, bound to localhost, or on an isolated management segment is not reachable, and the practical blast radius depends on what data and control functions Trueview actually routes over MQTT. Overall footprint is further limited by the product's niche deployment.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) and SSVC (Automatable: yes, Technical Impact: total) both point to a trivially reachable, fully unauthenticated network flaw - consistent with an open MQTT broker. However, these high-severity signals contrast sharply with the exploitation-likelihood signals: EPSS is only 0.21% (11th percentile) and SSVC records Exploitation as 'none', indicating no observed activity and no mass-scanning pressure yet. This gap is best explained by prevalence rather than difficulty: Trueview is a niche CDAC product with a small deployment footprint, so real-world exploitation is low-probability even though technical exploitation is easy. The C:H/I:H rating is well-founded (anonymous read and write of all topics); the A:H component is more situational and depends on whether flooding or malicious publishes can disrupt dependent subscribers/operations - plausible but not independently confirmed. Net: a genuinely high-severity design flaw for any exposed instance, but organizational priority should be scaled by whether Trueview is actually deployed and whether port 1883 is network-reachable to untrusted parties.

An attacker who can reach the Trueview host on TCP/1883 points a standard MQTT client (e.g. mosquitto_sub/mosquitto_pub) at the broker with no credentials, subscribes to '#' to capture all message traffic, and then publishes crafted messages onto control or telemetry topics. Depending on how Trueview consumes those topics, this yields exposure of sensitive operational data and injection of attacker-chosen commands/state. No public exploit code is identified, though the GitHub README documents the reproduction steps.