CVE-2017-2894 Memory corruption in Mongoose

Critical 9.8 Published 7 Nov 2017 Updated 17 Sep 2024

A stack buffer overflow in Cesanta Mongoose allows remote code execution via a crafted MQTT SUBSCRIBE packet.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-2894?

CVE-2017-2894 is a critical memory corruption vulnerability in Cesanta Mongoose, published on 7 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

Weakness: CWE-787

Which versions are affected by CVE-2017-2894?

It affects 1 product.

Products include Cesanta Mongoose.

How do I fix CVE-2017-2894?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-2894 being exploited?

There is no known exploitation of CVE-2017-2894 in the wild and no public exploit code.

All Cesanta Mongoose vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-2894, GHSA-gm65-9xpq-9g64.