important · Mobile — Physical control
Any authenticated iSteamX user could monitor and control other customers’ steam generators.
Affects
MrSteam iSteamX, a mobile application and connected hub used to monitor and control residential steam generators.
An overbroad AWS policy exposed wildcard MQTT topics for other customers’ telemetry and start-or-stop commands.
Detail and 2 sources
CISA says vendor countermeasures became effective September 18 but names no fixed application or firmware build.