PT-2017-18713 · Eclipse+1 · Mosquitto+2

Published 2017-05-21 · Updated 2017-05-26 · CVE-2017-9131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mimosa Client Radios versions prior to 2.2.3 Mimosa Backhaul Radios versions prior to 2.2.3

Description An issue allows an attacker to gather information and craft a command to reboot a client remotely by connecting to the Mosquitto broker on an access point and one of its clients. This can be exploited to act as a DoS attack on the client by re-sending the command endlessly.

Recommendations For Mimosa Client Radios versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. For Mimosa Backhaul Radios versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Mosquitto broker to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-9131

Affected Products

Mimosa Backhaul Radios

Mimosa Client Radios

Mosquitto

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-9131 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9131 · Vendor Advisory
• http://blog.iancaling.com/post/160596244178 · Note