A critical authentication bypass vulnerability in Eclipse Arrowhead allows unauthenticated remote attackers to gain full management access via MQTT by spoofing system operator certificates.

The vulnerability exists in the CertificateMqttFilter component, which incorrectly processes X.509 certificates provided within MQTT message payloads. By failing to verify signatures or validate issuer chains against a trust store, the application allows an unauthenticated attacker to craft a self-signed certificate that grants them system operator privileges.

The ability for an unauthenticated user to assume the role of a system operator constitutes a complete compromise of the affected MQTT-based management services. Given the CVSS score of 9.5, this vulnerability represents a critical risk, potentially leading to unauthorized system control, data manipulation, and the total loss of confidentiality and integrity within the Arrowhead cloud environment.

Immediate Action: Upgrade to the latest version of Eclipse Arrowhead once a patch is released by the vendor. In the interim, disable the MQTT API if it is not strictly required for business operations.

Proactive Monitoring: Review MQTT broker access logs for suspicious connection attempts or messages containing unconventional X.509 certificate structures. Monitor for unexpected administrative commands originating from untrusted client sources.

Compensating Controls: Implement strict network-level segmentation to restrict access to the MQTT broker to known, authorized IP addresses. Ensure that all MQTT traffic is routed through a secure gateway that enforces TLS-level authentication before reaching the application layer.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a severe risk to the operational integrity of Eclipse Arrowhead deployments. Security teams should prioritize identifying all instances of the software running the affected MQTT API and implement restrictive network controls immediately. Once the vendor provides a remediation, applying the update is mandatory to prevent potential unauthorized access and system takeover.