Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
204 results · page 3 of 5
May 6, 2025The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid.CVE-2025-4384 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages.CVE-2025-27615 · Other software · umati · reported by GitHubHigh 8.2
umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 uses `127.0.0.1:8080:8080` to limit access to the local network. For those who are unable to use this proposed patch, a firewall on Port 8080 may block remote access, but the workaround may not be perfect because Docker may also bypass a firewall by its iptable based rules for port forwarding.
- Product
- umatiGateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tappinCVE-2025-0681 · Other software · New Rock Technologies · reported by ics-cert@hq.dhs.govMedium 6.9
The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.
- Product
- OM500 IP-PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govnewrocktech.com
Jan 24, 2025SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content.CVE-2024-50698 · Other software · Sungrowpower · reported by MITRECritical 9.8
SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content.
- Product
- Winet-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient boundsCVE-2024-50697 · Other software · Sungrowpower · reported by MITREHigh 8.1
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow.
- Product
- Winet-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds cCVE-2024-50695 · Other software · Sungrowpower · reported by MITRECritical 9.8
SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks.
- Product
- Winet-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of CVE-2024-50694 · Other software · Sungrowpower · reported by MITRECritical 9.8
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow.
- Product
- Winet-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverCVE-2024-50692 · Other software · Sungrowpower · reported by MITREMedium 5.4
SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT communications are vulnerable to MitM attacks at the TCP/IP level.
- Product
- Winet-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.sungrowpower.commqtt-pwn.readthedocs.io
Jan 21, 2025The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker messaCVE-2024-42936 · Other software · Ruijie · reported by MITRECritical 9.8
The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT meCVE-2024-52324 · Other software · Ruijie · reported by ics-cert@hq.dhs.govCritical 9.2
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receCVE-2024-47791 · Other software · Ruijie · reported by ics-cert@hq.dhs.govHigh 8.7
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics.CVE-2024-46874 · Other software · Ruijie · reported by ics-cert@hq.dhs.govCritical 9.2
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentialCVE-2024-45722 · Other software · Ruijie · reported by ics-cert@hq.dhs.govHigh 8.7
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials.
- Product
- Reyee OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2024-50947 · Other software · kmqtt · reported by MITREHigh 7.5
An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- kmqtt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 3, 2024mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management.CVE-2024-50948 · Other software · mochimqtt · reported by MITREHigh 7.5
mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management. An attacker can exhaust system memory and crash the broker by establishing and maintaining a large number of malicious, long-term publish/subscribe sessions.
- Product
- mochimqtt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 15, 2024kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.CVE-2024-44775 · Other software · kmqtt · reported by MITREHigh 7.5
kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to an immediate process termination.
- Product
- kmqtt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by otCVE-2024-46549 · Other software · tplink · reported by MITREHigh 7.6
An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users.
- Product
- kasa_kp125m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system.CVE-2024-6786 · Other software · Moxa · reported by psirt@moxa.comMedium 6
The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files and JWT signing secrets.
- Product
- MXview One Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization.CVE-2024-39792 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.7
When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management.CVE-2024-36856 · Other software · rmqtt · reported by MITREHigh 7.5
RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the daemon by establishing and maintaining a vast number of long-lived malicious publish/subscribe sessions.
- Product
- rmqtt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 15, 2024An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices.CVE-2024-31856 · Other software · CyberPower · reported by ics-cert@hq.dhs.govHigh 8.8
An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injecting SQL syntax, writing arbitrary files to the system, and executing remote code.
- Product
- PowerPanel business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govcyberpower.com
May 15, 2024Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after CVE-2024-31409 · Other software · CyberPower · reported by ics-cert@hq.dhs.govMedium 6.5
Certain MQTT wildcards are not blocked on the CyberPower PowerPanel system, which might result in an attacker obtaining data from throughout the system after gaining access to any device.
- Product
- PowerPanel business
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govcyberpower.com
May 14, 2024A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30).CVE-2024-31486 · Other software · Siemens · reported by productcert@siemens.comMedium 6
A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.
- Product
- OPUPI0 AMQP/MQTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgcert-portal.siemens.com
Apr 17, 2024Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service.CVE-2024-31041 · Other software · emqx · reported by MITREHigh 7.5
Null Pointer Dereference vulnerability in topic_filtern function in mqtt_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of service.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a serieCVE-2024-31040 · Other software · emqx · reported by MITRELow 2.7
Buffer Overflow vulnerability in the get_var_integer function in mqtt_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of service via a series of specially crafted hexstreams.
- Product
- nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands aCVE-2023-1083 · Other software · Welotec · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration commands, reboot commands and firmware updates.
- Product
- TK515L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Mar 25, 2024The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services.CVE-2024-29195 · Other software · Azure · reported by GitHubMedium 6
The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK, which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.
- Product
- azure-c-shared-utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when aCVE-2024-29862 · Other software · chirpstack · reported by MITREHigh 7.5
The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
- Product
- gateway-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack.CVE-2024-26001 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.4
An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
- Product
- CHARX SEC-3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Mar 12, 2024An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack.CVE-2024-26000 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comMedium 5.9
An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization.
- Product
- CHARX SEC-3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Feb 15, 2024INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials.CVE-2024-0390 · Other software · INPRAX · reported by cvd@cert.plCritical 9.8
INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access to manage and read parameters of the recuperation unit "reQnet iZZi".This issue affects "iZZi connect" application versions before 2024010401.
- Product
- iZZi connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024 MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.CVE-2023-49115 · Other software · MachineSense · reported by ics-cert@hq.dhs.govHigh 7.5
MachineSense devices use unauthenticated MQTT messaging to monitor devices and remote viewing of sensor data by users.
- Product
- FeverWarn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmachinesense.comcisa.gov
Nov 21, 2023The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code CVE-2023-6248 · Other software · Digital Communications Technologies · reported by cve@asrg.ioCritical 10
The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connected device. An attacker who knows the IP address of the server is able to connect and perform the following operations: * Get location data of the vehicle the device is connected to * Send CAN bus messages via the ECU module ( https://syrus.digitalcomtech.com/docs/ecu-1 https://syrus.digitalcomtech.com/docs/ecu-1 ) * Immobilize the vehicle via the safe-immobilizer module ( https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization https://syrus.digitalcomtech.com/docs/system-tools#safe-immobilization ) * Get live video through the connected video camera * Send audio messages to the driver ( https://syrus.digitalcomtech.com/docs/system-tools#apx-tts https://syrus.digitalcomtech.com/docs/system-tools#apx-tts )
- Product
- Syrus4 IoT Telematics Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigitalcomtech.comdigitalcomtech.com
Oct 25, 2023The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI CVE-2023-46102 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI device. The protocol builds on top of MQTT to implement the remote management of the device is encrypted with a hard-coded DES symmetric key, that can be retrieved reversing both the Android Client application and the server-side web application. This issue allows an attacker able to control a malicious MQTT broker on the same subnet network of the device, to craft malicious messages and send them to the HMI device, executing arbitrary commands on the device itself.
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Oct 25, 2023The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.CVE-2023-45851 · Other software · Bosch Rexroth AG · reported by psirt@bosch.comHigh 8.8
The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. This issue allows an attacker to force the Android Client application to connect to a malicious MQTT broker, enabling it to send fake messages to the HMI device
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Aug 9, 2023Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web serveCVE-2023-2905 · Other software · Cesanta · reported by cve@takeonme.orgHigh 8.8
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
- Product
- Mongoose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the bCVE-2023-33379 · Other software · connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.
- Product
- connected_io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT.CVE-2023-33372 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Jun 12, 2023NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.CVE-2023-34494 · Other software · Emqx · reported by MITREHigh 7.5
NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.CVE-2023-34488 · Other software · Emqx · reported by MITREHigh 7.8
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processes malformed messages.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles usiCVE-2023-3028 · Other software · Hangzhou Hopechart IoT Technology Co., Ltd. · reported by cve@asrg.ioHigh 8.6
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerabilities were identified: - The MQTT backend does not require authentication, allowing unauthorized connections from an attacker. - The vehicles publish their telemetry data (e.g. GPS Location, speed, odometer, fuel, etc) as messages in public topics. The backend also sends commands to the vehicles as MQTT posts in public topics. As a result, an attacker can access the confidential data of the entire fleet that is managed by the backend. - The MQTT messages sent by the vehicles or the backend are not encrypted or authenticated. An attacker can create and post messages to impersonate a vehicle or the backend. The attacker could then, for example, send incorrect information to the backend about the vehicle's location. - The backend can inject data into a vehicle´s CAN bus by sending a specific MQTT message on a public topic. Because these messages are not authenticated or encrypted, an attacker could impersonat
- Product
- HQT401
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.cCVE-2023-29995 · Other software · Emqx · reported by MITREHigh 7.5
In NanoMQ v0.15.0-0, a Heap overflow occurs in copyn_utf8_str function of mqtt_parser.c
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.CVE-2023-29994 · Other software · Emqx · reported by MITREHigh 7.5
In NanoMQ v0.15.0-0, Heap overflow occurs in read_byte function of mqtt_code.c.
- Product
- Nanomq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT.CVE-2022-43704 · Other software · Sinilink · reported by MITREMedium 5.9
The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol (udp/1024) commands interfacing directly with the target device. This, in turn, allows for an attack to control the onboard relay without requiring authentication via the mobile application. This might result in an unacceptable temperature within the target device's physical environment.
- Product
- Xy-wft1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Dec 27, 2022Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials.CVE-2022-45423 · Network & remote access · Dahuasecurity · reported by cybersecurity@dahuatech.comHigh 7.5
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited).
- Product
- DSS Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddahuasecurity.comdahuasecurity.com
Nov 11, 2022 IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels.CVE-2022-31772 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 13, 2022A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected CVE-2022-35612 · Other software · Bevywise · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in MQTTRoute v3.3 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the dashboard name text field.
- Product
- Mqttroute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Oct 13, 2022A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.CVE-2022-35611 · Other software · Bevywise · reported by MITREMedium 4.3
A Cross-Site Request Forgery (CSRF) in MQTTRoute v3.3 and below allows attackers to create and remove dashboards.
- Product
- Mqttroute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Feb 4, 2022A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc.CVE-2021-21959 · Other software · Sealevel · reported by talos-cna@cisco.comHigh 8.1
A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality.
- Product
- Seaconnect 370w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 31, 2021wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Subscribe).CVE-2021-45939 · Other software · Wolfssl · reported by MITREMedium 5.5
wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Subscribe).
- Product
- Wolfmqtt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.