Vulnerability · Published Jan 7, 2026 · Assigned by S21sec
CVE-2026-22535FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS
High 8.9
In plain English
A high-severity security flaw in QC 60/90/120 from EFACEC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EFACEC | QC 60/90/120 | 8 |
Weakness: CWE-1366 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H