PT-2025-48360 · Unknown · Ais-Catcher

Jaenact · Publicado 2025-11-29 · Atualizado 2025-12-01 · CVE-2025-66217

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AIS-catcher versions prior to 0.64

Description AIS-catcher, a multi-platform AIS receiver, contains a flaw in its MQTT parsing logic. An integer underflow can be triggered by sending a crafted MQTT packet with a modified Topic Length field. This can cause a significant Heap Buffer Overflow, resulting in a Denial of Service (DoS). When used as a library, this can also lead to severe Memory Corruption, potentially enabling Remote Code Execution (RCE). The issue is related to the parsing of the Topic Length field within MQTT packets.

Recommendations Update to version 0.64 or later.

Exploit

Correção

RCE

DoS

Integer Underflow

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-191

CWE-122

Identificadores relacionados

CVE-2025-66217

GHSA-93MJ-C8Q3-69RG

Produtos afetados

Ais-Catcher

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66217.json · Exploit
• 🔥 https://github.com/jvde-github/AIS-catcher/security/advisories/GHSA-93mj-c8q3-69rg · Exploit
• https://github.com/jvde-github/AIS-catcher/commit/e0f7242eee659909adc11a4c561c3f7011bdefe7 · Correção
• https://twitter.com/SecAideInfo/status/1995437352332984782 · Publicação no Twitter
• https://t.me/CVEtracker/38462 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-66217 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-66217 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1994618320402694309 · Publicação no Twitter
• https://t.me/cveNotify/144412 · Publicação no Telegram