Isteamx Hub
Monthly
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.