CVE-2017-2922
CriticalSummary
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
Risk Assessment
The organization is at risk of remote code execution by an attacker who can exploit this vulnerability by sending a specially crafted websocket packet.
Recommendation
It is recommended to update to the latest version of Cesanta Mongoose to mitigate this vulnerability and to monitor network traffic for suspicious websocket packets.
Original NVD description (English source)
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability.