search

softypit / esp32_mqtt_eq3

esp32-based mqtt node to control EQ-3 BLE TRVs
146 stars 48 forks source link

mqtt_password exposed #49

Open pyx1337 opened 4 years ago

pyx1337 commented 4 years ago

After saving the configuration on the esp you can see the mqtt password in cleartext via the webinterface, so everyone in the wifi could see it.

softypit commented 4 years ago

Normally we would expect the devices to exist within a 'friendly' network or a private subnet so display of the mqtt password should not be an issue. However there is no benefit to the display of mqtt user/pass on the status page so I have removed them and added system uptime in the latest beta (1.55). Please note that any network user with access to the web interface can easily find the mqtt password from the configuration page using 'show source' in the browser or network snooping with wireshark.

Paul.