Executive brief
AWS IoT Device SDK for Python is widely used by IoT devices and gateways to securely communicate with AWS IoT Core. A flaw in TLS certificate validation allows an attacker on the network to impersonate the legitimate AWS IoT Core endpoint by presenting any valid certificate, potentially exposing device data and allowing remote command injection. This affects both the primary connection methods used by IoT devices: direct X.509 authentication and WebSocket connections.
Technical details
The vulnerability is a certificate host mismatch validation bypass in the MQTT client TLS connection layer of AWSIoTPythonSDK versions 1.5.3 to 1.6.0 running on Python 3.7 and later. The SDK fails to verify that the server's TLS certificate CN or SAN matches the AWS IoT Core endpoint hostname, allowing an adversary-in-the-middle to present any valid certificate signed by a trusted CA to impersonate the legitimate endpoint. The attack vector is network-based and does not require authentication or user interaction. An attacker can read device telemetry and inject malicious MQTT messages that the device accepts as legitimate. The WebSocket with SigV4 path on port 443 and the ALPN path on port 443 were not affected. Patches are available in later SDK versions.
Affected products
- AWS IoT Device SDK for Python >=1.5.3 AND <=1.6.0 (Python 3.7 and later)
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory: AWS Security Bulletin 2026-115-AWS published