CVE-2017-2892: Integer Overflow

Published Nov 7, 2017

Updated

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

Affected Software

1 affected component

Cesanta Mongoose=6.8

Event History

Nov 7, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2017-2892?

CVE-2017-2892 is an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.

How severe is CVE-2017-2892?

CVE-2017-2892 has a severity rating of 9.8 which is considered critical.

What is affected by CVE-2017-2892?

Cesanta Mongoose 6.8 is affected by CVE-2017-2892.

What is the potential impact of CVE-2017-2892?

CVE-2017-2892 can potentially result in information disclosure, denial of service, and remote code execution.

Is there a fix for CVE-2017-2892?

Unfortunately, there is no information available about a fix for CVE-2017-2892 at this time.