CVE-2025-15573

9.4 criticalEPSS 0.2%

Critical (9.4). EPSS 0.2% chance of exploitation in the next 30 days.

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to devices.

Severity

CVSS 3.1

9.4 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2026-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://r.sec-consult.com/solax

Check your stack JSON