ads-tec Industrial IT: Mosquitto MQTT Client Vulnerability in ADS-TEC IRF Products
The ADS-TEC firewall products IRF1000, IRF2000, and IRF3000 include Eclipse Mosquitto, affected by multiple vulnerabilities. Exploitation requires a compromised upstream MQTT broker, limiting direct device exposure.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3935US | medium6.5 | — | ||
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming top… | ||||
| CVE-2024-10525US | critical9.8 | — | ||
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bound… | ||||
| CVE-2024-8376US | high7.5 | — | ||
In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNEC… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- Mitigation
Disable MQTT publishing or ensure connections are made only to trusted and TLS-secured MQTT brokers.
- Mitigation
Disable MQTT publishing or ensure connections are made only to trusted and TLS-secured MQTT brokers.
- Mitigation
Disable MQTT publishing or ensure connections are made only to trusted and TLS-secured MQTT brokers.
- Behoben
Update to firmware IRF1000 v2.1.0, IRF2000 v6.1.0, IRF3000 v2.1.0 or later.
- Behoben
Update to firmware IRF1000 v2.1.0, IRF2000 v6.1.0, IRF3000 v2.1.0 or later.
- Behoben
Update to firmware IRF1000 v2.1.0, IRF2000 v6.1.0, IRF3000 v2.1.0 or later.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan