An ordinary iSteamX account could use wildcard MQTT permissions to read other customers’ telemetry and start or stop their steam generators.

Vendor countermeasures took effect September 18, but the public record gives no fixed version identifiers.