{"id":"CVE-2026-102717","published":"2026-09-30T15:22:21.957","lastModified":"2026-09-30T20:17:22.990","description":"MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125","CWE-457"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-hp64-f44f-wjw6","tags":[]}],"hasPoc":true,"ai":{"summary":"MQTT WebSocket setter ABI mismatch allows memory disclosure or crashes, potentially leading to information leakage or service disruption. This vulnerability affects the way MQTT handles WebSocket connections and can be exploited through improper data handling in the ABI interface.","exploitability":"Exploitation is moderately difficult and requires a crafted MQTT WebSocket connection with specific payload patterns that trigger the ABI mismatch, typically requiring network access to the MQTT broker.","blast_radius":"If exploited, this vulnerability could impact all MQTT clients connected through WebSocket, potentially causing widespread service disruption or allowing attackers to read sensitive memory contents from the broker.","remediation":"Upgrade to version 2.590 or later to address the ABI mismatch in MQTT WebSocket handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["mqtt","websocket","memory-disclosure"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:37.176Z"}}