How severe is CVE-2017-2894?

CVE-2017-2894 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-2894 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-2894?

CVE-2017-2894 affects Cesanta Mongoose. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-2894?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2017-2894 published?

CVE-2017-2894 was published on 2017-11-07 and last updated on 2026-06-17.

CVE-2017-2894

CVE-2017-2894 is a critical-severity vulnerability in Cesanta Mongoose with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-787.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 31% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-787
Affected product: Cesanta Mongoose
Published: 2017-11-07
Last modified: 2026-06-17

Description

An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

Frequently asked questions

What is CVE-2017-2894?: An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.
How severe is CVE-2017-2894?: CVE-2017-2894 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-2894 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-2894?: CVE-2017-2894 affects Cesanta Mongoose. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-2894?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2017-2894 published?: CVE-2017-2894 was published on 2017-11-07 and last updated on 2026-06-17.

References

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0401

Affected products (1)

cpe:2.3:a:cesanta:mongoose:6.8:*:*:*:*:*:*:*

More vulnerabilities in Cesanta Mongoose

CVE-2022-25299 — Critical (CVSS 9.8): This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using…
CVE-2020-25756 — Critical (CVSS 9.8): A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of…
CVE-2019-19307 — Critical (CVSS 9.8): An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS…
CVE-2019-12951 — Critical (CVSS 9.8): An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based…
CVE-2018-20356 — Critical (CVSS 9.8): An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in…
CVE-2018-20355 — Critical (CVSS 9.8): An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in…

All CVEs affecting Cesanta Mongoose →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

CVE-2026-42369 — Critical (CVSS 10.0): GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other…
CVE-2026-4746 — Critical (CVSS 10.0): Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is…
CVE-2025-43300 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2024-39791 — Critical (CVSS 10.0): Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge…

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →