CVE-2017-2893high

CVE-2017-2893: high-severity vulnerability in Cesanta Mongoose

Published · Updated

Follow this CVE+ Monitor Mongoose+ Monitor smplayer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 25%
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Cesanta · Mongoose
Related CVEs — Cesanta Mongoose

In the same product, most dangerous first.

CVE-2017-2894CRITICALCVE-2017-2894EPSS 31.0%CVE-2017-2892CRITICALCVE-2017-2892EPSS 3.0%CVE-2017-2891CRITICALCVE-2017-2891EPSS 2.8%CVE-2017-2922CRITICALCVE-2017-2922EPSS 2.6%CVE-2017-2921HIGHCVE-2017-2921EPSS 2.4%CVE-2017-2909HIGHCVE-2017-2909EPSS 1.4%