EUVD-2026-84816
GHSA-h8q6-7rjx-3m2r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must control or impersonate the broker the client dials out to (MITM/malicious broker); PR:N/UI:N as no creds or interaction needed, full memory-corruption RCE gives C/I/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
6DescriptionCVE.org
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
AnalysisAI
An out-of-bounds write in the MQTT client module of the lwIP TCP/IP stack lets an adversary who controls or impersonates the MQTT broker that a device connects to corrupt heap/stack memory and potentially achieve full code execution on that device. Only devices built with lwIP's optional MQTT client compiled in are exposed, and because MQTT connections are client-initiated the device is not directly reachable inbound: the attacker must operate a malicious broker, compromise the legitimate broker, or hold a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or certificate validation is disabled). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the target device to be running the lwIP TCP/IP stack's optional MQTT client module, and (2) the attacker to control or impersonate the MQTT broker that client connects to - either by operating a malicious broker the device is configured to reach, compromising the legitimate broker, or taking a man-in-the-middle position on the client-to-broker path (feasible where TLS is absent or unverified). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) presents this as a trivially exploitable unauthenticated remote code execution flaw, but the mechanism materially qualifies that headline. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the available intelligence; the primary action is to monitor CISA ICSA-26-265-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01) and the upstream lwIP project at https://savannah.nongnu.org/projects/lwip for an upstream commit or release containing the bounds-check fix, and to track downstream firmware vendors for updated images. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, direct engineering to inventory every product, firmware image, and build configuration that compiles in the lwIP MQTT client, prioritizing lwIP-based embedded and IoT devices in customer-facing or Internet-adjacent deployments, and confirm whether the optional MQTT client is enabled; where it is enabled but unused, remove it from the build. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Moquette MQTT brokers running versions prior to 0.18.1 fail to enforce topic write ACLs on Last Will and Testament messa
Improper TLS hostname validation in the MQTT client layer of AWS IoT Device SDK for Python (AWSIoTPythonSDK) 1.5.3 throu
Remote unauthenticated clients can crash a Moquette MQTT broker running 0.18.0 or earlier by publishing or subscribing w
Hardcoded MQTT credentials shipped inside Bransys ELD grant unauthenticated read access to real-time telemetry for every
Malformed MQTT PUBLISH frames leak packet buffers in the Eclipse ThreadX NetX Duo MQTT client, letting a peer that can d
An out-of-bounds read in Eclipse ThreadX NetX Duo's MQTT-over-WebSocket transport (the setter path) lets a malicious or
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client
Loopback source-address restriction bypass in RabbitMQ's native MQTT and MQTT-over-WebSocket listeners (all releases fro
Authorization bypass in RabbitMQ's MQTT topic permission handling allows a low-privileged authenticated user to broaden
Authenticated users of FlashMQ MQTT brokers running versions prior to 1.23.2 can cause a gradual memory leak by creating
NanoMQ MQTT brokers prior to 0.24.14 can be driven unresponsive by a remote unauthenticated client that sends MQTT v5 PU
The NanoMQ MQTT client (versions prior to 0.24.14) can be hung and driven into a CPU- and memory-consuming infinite loop
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today