|Date: (C)2017-11-08 (M)2017-11-16|
|CVSS Score: 6.8||Access Vector: |
|Exploitability Subscore: ||Access Complexity: |
|Impact Subscore: ||Authentication: |
| ||Confidentiality: |
| ||Integrity: |
| ||Availability: |
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.