Research shows pre-auth RCE in Eclipse Mosquitto on Home Assistant Green
Research posted to Reddit r/netsec describes pre-authentication remote code execution in the Eclipse Mosquitto MQTT broker as embedded in the Home Assistant Green home hub. The post cites no CVE, affected versions, or fix. Owners should watch for updates and limit the device's internet exposure.
What happened
Research posted to Reddit r/netsec describes a remote code execution flaw exploitable without authentication in Eclipse Mosquitto, the MQTT broker embedded in the Home Assistant Green home hub. The post shows the device being compromised. The text offers no details beyond the title.
Why it matters
Home Assistant Green is a home automation hub. A flaw allowing unauthenticated remote code execution could let an attacker take over the device. The source gives no details on exposed data or scope beyond the device.
What to do
Watch for updates to Home Assistant Green and Mosquitto. Until a fix ships, limit the device's internet exposure and restrict hub access to trusted networks.
For the technical team
- Affected
- Eclipse (projeto Mosquitto) Eclipse Mosquitto, broker MQTT embarcado no Home Assistant Green · Home Assistant Green, with the embedded Mosquitto. The source cites no affected versions.
- Exploitation
- Demonstrated in research posted to Reddit r/netsec by user parzel. The source reports no in-the-wild exploitation and cites no CVE.
- Fix
- The source mentions no fix, patched versions, or mitigation.
- Vector
- Eclipse Mosquitto MQTT broker, as embedded in Home Assistant Green. Remote code execution flaw exploitable before authentication (pre-auth). The source gives no further exploitation conditions.
- More details
- The only source is the title of the Reddit r/netsec post, with no body text. Technical details such as attack chain, versions, and CVE are not available in the material.
Timeline
Incident opened.
