CyberSec.Space Logo
Back to CVE Browser

CVE-2017-2922

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0970%
EPSS Percentile19.26th
PublishedNov 7, 2017
Last ModifiedMay 13, 2026

Vulnerability Description

An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can cause a buffer to be allocated while leaving stale pointers which leads to a use-after-free vulnerability which can be exploited to achieve remote code execution. An attacker needs to send a specially crafted websocket packet over the network to trigger this vulnerability.

Affected Platforms (CPE)

📦
Cesanta

Mongoose

= 6.8

References & Advisories

🔗 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0429
🔗 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0429

Related Vulnerabilities

CVE-2017-28929.8

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A spec...

CVE-2017-28919.8

An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POS...

CVE-2017-28949.8

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A spec...

CVE-2017-29219.8

An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A speciall...