CVE-2025-14847
highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 0.832 · 100. PerzentilExploit · funktionalCHDEEUNLRUUShinzugefügt 2025-12-29beheben bis 2026-01-19
erforderliche Maßnahme Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · bewertet 2026-10-23
MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allabb_psirt
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationIIoT services with MongoDB 4.2 installed on ABB Ability Zenon /allcisa_csaf_ot
ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on MongoDB without affecting other zenon components. Refer to section “General security recommendations” for further advise on how to keep your system secure.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (42)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- 0xBlackash/CVE-2025-14847CVE-2025-14847PoC · poc_in_github
- AdolfBharath/mongobleedCVE-2025-14847 explaination and lab PoC · poc_in_github
betroffene Produkte (61)
Betroffene Produkte und Versionsbereiche.
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- 9AKK108472A9037ABB AbilityTM zenon Security Risk Due to End-of-Life MongoDB Component2026-07-30csaf · abb_psirtCH
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
- NCSC-2025-0402Kwetsbaarheid verholpen in MongoDBNL2025-12-27csaf · ncsc_nlNL
De ontwikkelaars van MongoDB hebben een kwetsbaarheid verholpen in MongoDB.
- WID-SEC-W-2025-2905MongoDB: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-12-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MongoDB ausnutzen, um Informationen offenzulegen.
- ICSA-26-218-01ABB Ability Zenon2026-07-30icsa · cisa_csaf_otUS
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.
- BIT-mongodb-2025-14847Zlib compressed protocol header length confusion may allow memory read2025-12-19vendor · osvUS
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-14847cnnvd
- https://jira.mongodb.org/browse/SERVER-115508cnnvd
- https://vigilance.fr/vulnerability/MongoDB-Server-out-of-bounds-memory-reading-via-Zlib-Compressed-Protocol-Headers-49179cnnvd
- https://jira.mongodb.org/browse/SERVER-115508enisa_euvd
- http://www.openwall.com/lists/oss-security/2025/12/29/21Mailing Listnvd
- https://jira.mongodb.org/browse/SERVER-115508Issue TrackingPatchVendor Advisorynvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847Third Party AdvisoryUS Government Resourcenvd
- https://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847Technical DescriptionThird Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan