26 matches found
CVE-2026-15891
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
CVE-2026-15891
CVE-2026-15891 is a NULL pointer dereference in the Zephyr RTOS MQTT-SN client. The keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c discards the return value of SYS_SLIST_PEEK_HEAD_CONTAINER, leaving the gw pointer as NULL. The code then dereferences gw->gw_id and passes i...
CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
CVE-2026-15891 NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
EUVD-2026-77132
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
PT-2026-90983
The MQTT-SN client keepalive handler process ping in subsys/net/lib/mqtt sn/mqtt sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS SLIST PEEK HEAD CONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign t...
CVE-2026-15891: NULL Pointer Dereference
The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...
CVE-2019-16754
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation asymcute, potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message an...
EUVD-2019-7793
Malware in sbrugna...
EUVD-2019-7291
Malware in sbrugna...
CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
Design/Logic Flaw
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
CVE-2019-17389
In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors during a UDP read, causing the receive loop to terminate. This can allow an attacker to disrupt a RIOT MQTT-SN client by sending a large packet, preventing operation until the device is restarted. (CVE-2019-17389)
PT-2019-15123
Name of the Vulnerable Software and Affected Versions RIOT version 2019.07 Description The MQTT-SN implementation in RIOT mishandles errors during a read operation on a UDP socket, causing the receive loop to end. This allows an attacker to prevent a RIOT MQTT-SN client from working until the...
CVE-2019-17389: Undefined Security Weakness
In RIOT 2019.07, the MQTT-SN implementation asymcute mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows an attacker via a large packet to prevent a RIOT MQTT-SN client from working until the device is restarted...
CVE-2019-16754
RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation asymcute, potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message an...