« Volver al listado

CVE-2026-44725

Estado: AplazadaMedia (6.6)—

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding.

Leer descripción completaMostrar menos

An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Emqx — EmqxAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-44725",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44725",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-21T21:00:30.568823Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "emqx",
          "product": "emqx",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.8.11"
            },
            {
              "status": "affected",
              "version": ">= 5.9.0, < 5.9.3"
            },
            {
              "status": "affected",
              "version": ">= 5.10.0, < 5.10.4"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.0.3"
            },
            {
              "status": "affected",
              "version": ">= 6.1.0, < 6.1.2"
            },
            {
              "status": "affected",
              "version": ">= 6.2.0, < 6.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-20T15:17:30.003",
  "references": [
    {
      "url": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/pull/17200",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/pull/17201",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/releases/tag/6.0.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/releases/tag/6.1.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/releases/tag/6.2.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/releases/tag/e5.10.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/releases/tag/e5.8.11",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-672"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1."
    }
  ],
  "lastModified": "2026-09-18T20:09:01.757",
  "sourceIdentifier": "security-advisories@github.com"
}