The AWS IoT Device SDK for Python (AWSIoTPythonSDK) versions >=1.5.3 and <=1.6.0 running on Python 3.7 and later contain a CWE-297 vulnerability where the MQTT client TLS connection layer fails to validate that the server certificate matches the AWS IoT Core endpoint hostname. This flaw allows an adversary positioned as a man-in-the-middle to present a valid certificate for an unrelated hostname from the device's trust store, impersonate the AWS IoT Core endpoint, read device telemetry data, and inject arbitrary MQTT messages that the device accepts as authentic. The vulnerability affects both the default connection paths: X.509 mutual authentication on port 8883 and WebSocket with SigV4 on port 443. The port 443 ALPN path is not affected. AWS has published a security bulletin and a patch to remediate this issue.

An attacker with network positioning can impersonate the AWS IoT Core endpoint by presenting a certificate for an unrelated hostname, enabling interception of sensitive telemetry data and injection of malicious MQTT messages. This compromises confidentiality, integrity, and availability of the IoT device communications. The vulnerability affects critical IoT device communication channels, potentially allowing unauthorized control or data leakage.

A patch is available from AWS to fix this vulnerability. Users of AWSIoTPythonSDK versions >=1.5.3 and <=1.6.0 on Python 3.7 and later should upgrade to the fixed version as per the AWS security bulletin (https://aws.amazon.com/security/security-bulletins/2026-114-aws/). Since this is a cloud service SDK, AWS manages the cloud infrastructure, but device-side SDK updates are required to mitigate the issue. Check the vendor advisory for the latest remediation instructions.