vendor:
Mongoose OS
by:
Philipp Promeuschel, Carel van Rooyen, Stephan Sekula
7,5
CVSS
HIGH
Use-after-free / Denial of Service
416
CWE
Product Name: Mongoose OS
Affected Version From: <= Release 1.2
Affected Version To: N/A
Patch Exists: YES
Related CWE: CVE-2017-7185
CPE: a:cesanta:mongoose_os
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: ESP32, ESP8266, STM32, TI CC3200
2017
Mongoose OS Use-after-free / Denial of Service
The handling of HTTP-Multipart boundary headers does not properly close connections when malformed requests are sent to the Mongoose server. This leads to a use-after-free/null-pointer-de-reference vulnerability, causing the Mongoose HTTP server to crash. As a result, the entire system is rendered unusable.
Mitigation:
Upgrade to the patched version of Mongoose OS.