CVE-2017-2894critical

CVE-2017-2894: critical vulnerability in Cesanta Mongoose

Published · Updated

Follow this CVE+ Monitor Mongoose+ Monitor smplayer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 31%
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Cesanta · Mongoose
Related CVEs — Cesanta Mongoose

In the same product, most dangerous first.

CVE-2017-2893HIGHCVE-2017-2893EPSS 24.9%CVE-2017-2892CRITICALCVE-2017-2892EPSS 3.0%CVE-2017-2891CRITICALCVE-2017-2891EPSS 2.8%CVE-2017-2922CRITICALCVE-2017-2922EPSS 2.6%CVE-2017-2921HIGHCVE-2017-2921EPSS 2.4%CVE-2017-2909HIGHCVE-2017-2909EPSS 1.4%