Data Exposure Vulnerability in SunGrow's iSolarCloud MQTT Service

CVE-2025-29756

What is CVE-2025-29756?

The iSolarCloud backend relies on an MQTT service for transmitting data from connected devices to users. However, the service lacks adequate restrictions, allowing unauthorized subscription to any topic. As a result, attackers with valid iSolarCloud accounts can exploit this weakness to extract MQTT credentials and encryption keys through the browser, granting them access to all messages sent from connected devices. This vulnerability highlights critical lapses in user data protection measures within the MQTT implementation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References