CVE-2017-7650: Medium severity Eclipse Mosquitto vulnerability
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7650?
CVE-2017-7650 has a Medium severity rating due to the potential for unauthorized access to MQTT topics.
How do I fix CVE-2017-7650?
To fix CVE-2017-7650, upgrade to Eclipse Mosquitto version 1.4.12 or later.
Who is affected by CVE-2017-7650?
CVE-2017-7650 affects users of Eclipse Mosquitto versions prior to 1.4.12 and Debian Debian Linux 8.0.
What is the exploit mechanism for CVE-2017-7650?
The exploit mechanism for CVE-2017-7650 involves clients bypassing pattern-based ACLs by setting their username or client ID to '#' or '+.'
Is CVE-2017-7650 specific to a certain version of Mosquitto?
Yes, CVE-2017-7650 specifically affects versions of Mosquitto prior to 1.4.12.