PT-2017-18713 · Eclipse+1 · Mosquitto+2

Publicado 2017-05-21 · Atualizado 2017-05-26 · CVE-2017-9131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.3 Mimosa Backhaul Radios versions prior to 2.2.3

Description An issue allows an attacker to gather information and craft a command to reboot a client remotely by connecting to the Mosquitto broker on an access point and one of its clients. This can be exploited to act as a DoS attack on the client by re-sending the command endlessly.

Recommendations For Mimosa Client Radios versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. For Mimosa Backhaul Radios versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Mosquitto broker to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-9131

Produtos afetados

Mimosa Backhaul Radios

Mimosa Client Radios

Mosquitto

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9131 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-9131 · Aviso do Fabricante
• http://blog.iancaling.com/post/160596244178 · Nota