The iSteamX mobile application had an AWS policy misconfiguration that granted authenticated users access to wildcard MQTT topics. This lack of proper compartmentalization (CWE-653) allowed unauthorized access to other users' device data and control over their devices. The vulnerability affects version 4.2.1 of the application and was addressed by the vendor with a patch. The CVSS 4.0 score is 8.4 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

Exploitation of this vulnerability could expose sensitive user profile information and allow attackers to remotely start or stop devices of other users. This could lead to privacy breaches and physical safety risks, such as scalding from unintended device activation.

A patch is available and should be applied to remediate this vulnerability. Since the affected product is a cloud service, the vendor manages remediation server-side. Users and administrators should verify that their iSteamX application is updated to the fixed version or that the vendor's cloud service has been updated accordingly.