CVE-2017-2892

CVE-2017-2892 is a critical arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can lead to out-of-bounds memory read and write, potentially causing information disclosure, denial of service, or remote code execution. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network without authentication or user interaction, posing a high risk across all impact categories. While there is no evidence of active exploitation, public exploit code, or inclusion in the KEV catalog, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.