CVE-2017-2895: High severity mongoose os vulnerability
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-2895?
CVE-2017-2895 is an arbitrary memory read vulnerability found in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
How severe is CVE-2017-2895?
CVE-2017-2895 has a severity rating of 8.2 out of 10.
What is the affected software of CVE-2017-2895?
Cesanta Mongoose 6.8 is the affected software for CVE-2017-2895.
How can CVE-2017-2895 be exploited?
CVE-2017-2895 can be exploited by sending a specially crafted MQTT SUBSCRIBE packet.
What are the potential consequences of CVE-2017-2895?
CVE-2017-2895 can result in information disclosure and denial of service.