CVE-2018-18765: Critical severity mongoose os vulnerability

Published Oct 28, 2018

Updated

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mgmqttnextsubscribetopic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

Affected Software

1 affected component

Cesanta Mongoose=6.13

Event History

Oct 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is CVE-2018-18765?

CVE-2018-18765 is an exploitable arbitrary memory read vulnerability that exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13.

How severe is CVE-2018-18765?

CVE-2018-18765 has a severity rating of 9.1, which is considered critical.

Which software is affected by CVE-2018-18765?

Cesanta Mongoose version 6.13 is affected by CVE-2018-18765.

How can CVE-2018-18765 be exploited?

CVE-2018-18765 can be exploited by sending a specially crafted MQTT SUBSCRIBE packet.

Is there a fix for CVE-2018-18765?

At the time of writing, there is no known fix for CVE-2018-18765. It is recommended to update to a patched version when available.