PT-2024-21274 · Unknown · Mqtt Stack

Carlo Meijer + 1 · Published 2024-03-12 · Updated 2025-01-24 · CVE-2024-26001

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The MQTT stack is susceptible to an unauthenticated remote attack due to improper input validation, allowing an attacker to write memory out of bounds. The brute force attack is not always successful because of memory randomization. An exploit for this issue may exist, with potential links to the exploit code available at https://t.co/iVuBGZrI6Y. Unfortunately, the specific versions of the MQTT stack affected are not mentioned in the provided text. #MQTT #cybersecurityawareness #cybersecurity #infosec #hacker #mqttstack #remotattack #memoryrandomization

Fix

Memory Corruption

RCE

Weakness Enumeration

CWE-787

CWE-20

Related Identifiers

CVE-2024-26001

ZDI-24-862

Affected Products

Mqtt Stack

References · 8

• https://osv.dev/vulnerability/CVE-2024-26001 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-862 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-26001 · Security Note
• https://twitter.com/CVEnew/status/1767470011705180206 · Twitter Post
• https://t.me/cvenotify/108455 · Telegram Post
• https://twitter.com/cracbot/status/1767989695328252132 · Twitter Post
• https://cert.vde.com/en/advisories/VDE-2024-011 · Note
• https://twitter.com/VulmonFeeds/status/1767499893357044034 · Twitter Post