by Kastro
Paper/Archive/CVE-2026-92943

CVE-2026-92943

AWS AWSIoTPythonSDK — Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
34
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 32.1.321 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. To remediate this issue, users should upgrade to version 1.6.1.

Affected

ProductAffectedFixed inSource
AWSIoTPythonSDK1.5.3 – 1.6.0–CNA

Scores by source

AMZN (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AMZN (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchpypi.org/project/AWSIoTPythonSDK/1.6.1patchgithub.com/aws/aws-iot-device-sdk-python/releases/tag/v1.6.1advisoryaws.amazon.com/security/security-bulletins/2026-114-awsrefgithub.com/aws/aws-iot-device-sdk-python/security/advisories/GHSA-g7vp-3rxx-v25r