PT-2019-14813 · Riot · Riot

Nmeum · Published 2019-09-24 · Updated 2020-02-18 · CVE-2019-16754

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions RIOT version 2019.07

Description The issue is related to a NULL pointer dereference in the MQTT-SN implementation. An attacker could potentially crash a network node running the affected software by spoofing an MQTT server response. This would require knowledge of the MQTT MsgID of a pending MQTT protocol message, the ephemeral port used by the MQTT implementation, and the server IP address.

Recommendations For RIOT version 2019.07, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the MQTT-SN implementation in critical applications.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-16754

Affected Products

Riot

References · 3

• 🔥 https://github.com/RIOT-OS/RIOT/pull/12293 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16754 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16754 · Vendor Advisory