CVE-2024-42390 | Nozomi Networks Labs

Summary

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

Impact

A remote attacker can send an unexpected TLS packet and force the application to read unintended heap memory space.

Issue Date

November 14, 2024

Affects

This issue affects Mongoose Web Server v7.14

CVE Name

CVE-2024-42390

CVSS Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CVSS Score

4.3

Solution

It is highly recommended to not expose the vulnerable component inside an untrusted network.

Mitigations

Acknowledgements

Gabriele Quagliarella of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more