CVE-2017-2895
HighSummary
CVE-2017-2895 describes an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can lead to information disclosure and denial of service.
Risk Assessment
An attacker can exploit this vulnerability to gain access to sensitive data or cause service disruption, negatively impacting system availability.
Recommendation
It is recommended to update to the latest version of Cesanta Mongoose to mitigate this vulnerability and to monitor network traffic for potential attack attempts.
Other vulnerabilities in Cesanta Mongoose 6.8
See all- CVE-2017-2909High
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.
- CVE-2017-2893High
A NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8, which can lead to server crashes. Sending a specially crafted MQTT SUBSCRIBE packet by an attacker can trigger this vulnerability.
- CVE-2017-2922Critical
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
- CVE-2017-2921Critical
CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.
- CVE-2017-2894Critical
CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.
- CVE-2017-2892Critical
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.
- CVE-2017-2891Critical
CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.
- CVE-2026-11404High
Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.
Original NVD description (English source)
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.