Vulnerability Details CVE-2019-13120
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT Thing, which interacts with an associated vulnerable MQTT message in the application, specific circumstances could trigger this vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.5%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 4.3
References
Products affected by CVE-2019-13120
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.0.0
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.1.0
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.0
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.1
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.2
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.3
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.4
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.5
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.6
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.2.7
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.3.0
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.3.1
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.3.2
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.0
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.1
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.2
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.3
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.4
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.5
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.6
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.7
-
cpe:2.3:a:amazon:amazon_web_services_freertos:1.4.8