CVE-2019-16754 - CVE House
Back to Database
Status published High CVE-2019-16754

RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN...

Vulnerability Description

RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIOT. This requires spoofing an MQTT server response. To do so, the attacker needs to know the MQTT MsgID of a pending MQTT protocol message and the ephemeral port used by RIOT's MQTT implementation. Additionally, the server IP address is required for spoofing the packet.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-16754

Credits & Attribution

No credits recorded in the NVD database.

References

More from riot-os

View All →
CVE-2021-41061
In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the...
Medium 5.5
CVE-2021-31664
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which...
High 7.5
CVE-2021-31663
RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which...
High 7.5
CVE-2021-31662
RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which...
High 7.5
CVE-2021-31661
RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that...
High 7.5

Affected Vendor

Affected Software

riot
Vulnerable Versions:
2019.07

Timeline

Official Publish: September 24th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.