CVE-2026-95699
MrSteam iSteamX Improper Isolation or Compartmentalization
CVSS Score
9.6
EPSS Score
0.0%
EPSS Percentile
0th
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.
| CWE | CWE-653 |
| Vendor | mrsteam |
| Product | isteamx application |
| Published | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for mrsteam isteamx application
Be the first to know when new critical vulnerabilities affecting mrsteam isteamx application are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High
Affected Versions
MrSteam / iSteamX application
v1.3.42 (build 44)
MrSteam / iSteamX Hub
v4.2.1
References
Credits
Darren Challis