CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.5. See the original NVD description below for full technical details.
CVE
CVE-2019-13120
Severity
HIGH
CVSS
7.5
EPSS
1.19%
Original NVD Description
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
Related CVEs
Other vulnerabilities affecting the same vendor(s)