CVE-2023-3028
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedInsufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonate the backend, create a fake message and inject CAN data in any vehicle managed by the backend. The confirmed version is 201808021036, however further versions have been also identified as potentially impacted.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe HopeChart HQT-401 telematics unit's MQTT backend lacks authentication, allowing any unauthenticated attacker to connect. Vehicle telemetry (GPS, speed, odometer, fuel) is published in unencrypted public MQTT topics, exposing the entire fleet's confidential data. Additionally, the backend sends unauthenticated CAN bus injection commands via MQTT, enabling attackers to impersonate the backend and inject arbitrary data into any vehicle's CAN bus.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data= 201808021036CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Hopechart HQT-401 devices on your networkInventory your telematics/MQTT-connected devices and confirm if any are Hopechart HQT-401 units. Check device labels, management interfaces, or DHCP lease logs for this specific model name.Affected if You have one or more HQT-401 telematics units deployed.
-
Check installed firmware versionAccess the device management interface or use the vendor's diagnostic tool to retrieve the firmware version. Compare it against the affected version: 201808021036.Affected if Your device runs firmware version 201808021036 exactly.
-
Verify MQTT broker authentication settingsInspect your MQTT broker configuration (e.g., mosquitto.conf, broker ACL settings, or cloud provider settings). Check whether username/password authentication or client certificate authentication is required for new connections.Affected if The MQTT broker allows anonymous or unauthenticated connections from clients.
-
Inspect MQTT transport encryptionExamine your MQTT broker configuration for TLS/SSL settings. Verify that port 8883 (MQTT/TLS) or port 1883 with TLS wrapper is enforced, and that unencrypted connections on port 1883 are disabled or rejected.Affected if MQTT clients can connect over unencrypted channels (plaintext port 1883) without TLS.
-
Review MQTT topic access controlsCheck your MQTT broker ACL rules or broker permissions for the telemetry topics. Determine if any subscriber or publisher outside the expected backend can access vehicle data topics.Affected if The broker permits unauthorized subscribers or publishers to access vehicle telemetry topics.
You are affected if you have HQT-401 devices running firmware 201808021036 and your MQTT broker allows unauthenticated or unencrypted connections.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataEnable MQTT authentication (username/password or certificates), implement TLS encryption for all MQTT connections, add message signing/verification to prevent impersonation, and restrict topic access controls on the broker.
- Consultation8.0 h
- Implementation24.0 h
- Testing12.0 h
- Review / QA8.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $14,656.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-3028 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-3028 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data