The issue concerns the MQTT service used by iSolarCloud to transport data from connected devices to the user's web browser. The MQTT server lacks sufficient restrictions on topic subscriptions, allowing unauthorized access to data. Although the data is encrypted and MQTT credentials are obtained through an API call, an attacker can extract these credentials and the decryption key from the browser. This enables the attacker to subscribe to any topic, including the '#' topic, which would allow them to receive all messages from all connected devices.