VulnSocial

CVE-2026-92943Patch

LOWCVSS 9.2 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-297

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • Peaked at 4 mentions on most recent observed day (2026-09-18)
  • 5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-09-17: 1Mentions · 2026-09-18: 4Patch / Workaround · 2026-09-17: 1Patch / Workaround · 2026-09-18: 2Technical Details · 2026-09-17: 1Technical Details · 2026-09-18: 409-1709-18
Signal classification2 categories
Patch
360.0%
Disclosure
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-171
Patch1
2026-09-184
Disclosure2Patch2
Full discourse5 posts
  • Xcademia@xcademialtd
    Patch

    🚨 AWS IoT devices could be talking to the WRONG server. ⚠️ AWS has disclosed CVE-2026-92943, a certificate validation flaw in its IoT Device SDK for Python that could allow an attacker positioned on the network to impersonate an AWS IoT Core endpoint. 🔐 Certificate validation flaw 🎯 IoT devices at risk 📡 Telemetry could be intercepted 💉 Malicious MQTT messages could be injected Affected versions: 1.5.3 to 1.6.0 on Python 3.7+. AWS recommends upgrading to version 1.6.1. 🚨 Check your IoT SDK version 👇 https://www.xcademia.com/news/aws-warns-of-certificate-validation-flaw-in-iot-python-sdk #CyberSecurity #AWS #AWSIoT #IoT #CloudSecurity #Python #InfoSec #CyberAttack #TechNews #Xcademia

    Post summary

    The announcement details a certificate validation flaw in AWS IoT Device SDK for Python (CVE-2026-92943) and advises upgrading to version 1.6.1 to address the issue.

    1002062
    22 followersView on X
  • Ryan Merck@rmerck
    Disclosure

    I do not trust an MQTT client that skips hostname checks. AWS just confirmed the IoT Python SDK did exactly that through 1.6.0 on the default 8883 and SigV4 paths. A trusted-CA cert for the wrong name was enough. CVE-2026-92943. https://aws.amazon.com/security/security-bulletins/2026-114-aws

    Post summary

    The tweet discloses CVE-2026-92943 with specific technical details about AWS IoT Python SDK hostname verification bypass through version 1.6.0, but does not mention a PoC, active exploitation, named exploit tool, or explicit patch/workaround.

    1001058
    46 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: AWS IoT Device SDK for Python CVE-2026-92943 skips TLS hostname checks on MQTT. An on-path attacker can impersonate AWS IoT Core, read telemetry, and inject messages. Hits 1.5.3-1.6.0 on Python 3.7+. Upgrade to 1.6.1. https://www.rapid7.com/db/vulnerabilities/cve-2026-92943/

    Post summary

    CVE‑2026‑92943 allows an on‑path attacker to bypass TLS hostname checks in the AWS IoT Device SDK for Python (versions 1.5.3‑1.6.0), impersonating AWS IoT Core and reading/injecting telemetry. The fix is to upgrade to SDK version 1.6.1.

    00000102
    3.0K followersView on X
  • wenlong@waynexuel
    Disclosure

    This vulnerability features significant technical impact, as it allows attackers to compromise device data and system stability. CVE-2026-92943 - Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python https://daily.cnsre.cn/en/items/10cce884-6653-401b-8dc1-1160e78af481

    Post summary

    The text announces CVE-2026-92943, detailing it as an improper certificate validation vulnerability in AWS IoT Device SDK that compromises device data and system stability.

    0000048
    5 followersView on X
  • Xavier Rivera@XavierRiveraX
    Patch

    AWS disclosed CVE-2026-92943 in the IoT Device SDK for Python: improper certificate host validation on X.509 mutual auth (port 8883) and WebSocket SigV4 (port 443). Affected builds are 1.5.3 through 1.6.0 on Python 3.7+. Upgrade to AWSIoTPythonSDK 1.6.1.

    Post summary

    AWS disclosed CVE-2026-92943, an improper certificate host validation vulnerability in the IoT Device SDK for Python affecting versions 1.5.3 through 1.6.0, and advises users to upgrade to version 1.6.1.

    0000047
    601 followersView on X

Explore more

Back to dashboard