Search
Find a vulnerability
Search criteria
10 vulnerabilities found for emqx by emqx
CVE-2026-44725 (GCVE-0-2026-44725)
Vulnerability from nvd – Published: 2026-08-20 14:35 – Updated: 2026-08-21 21:47
VLAI
EPSS
VEX
Title
EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
Summary
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:00 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/emqx/emqx/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/emqx/emqx/pull/17200 | x_refsource_MISC |
| https://github.com/emqx/emqx/pull/17201 | x_refsource_MISC |
| https://github.com/emqx/emqx/commit/2f926359fa847… | x_refsource_MISC |
| https://github.com/emqx/emqx/commit/efa1ca1bef151… | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.0.3 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.1.2 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.2.1 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/e5.10.4 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/e5.8.11 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:00:30.568823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:47:37.335Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "emqx",
"vendor": "emqx",
"versions": [
{
"status": "affected",
"version": "\u003c 5.8.11"
},
{
"status": "affected",
"version": "\u003e= 5.9.0, \u003c 5.9.3"
},
{
"status": "affected",
"version": "\u003e= 5.10.0, \u003c 5.10.4"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.0.3"
},
{
"status": "affected",
"version": "\u003e= 6.1.0, \u003c 6.1.2"
},
{
"status": "affected",
"version": "\u003e= 6.2.0, \u003c 6.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672: Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:35:11.726Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r"
},
{
"name": "https://github.com/emqx/emqx/pull/17200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/pull/17200"
},
{
"name": "https://github.com/emqx/emqx/pull/17201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/pull/17201"
},
{
"name": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4"
},
{
"name": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.0.3"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.1.2"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.2.1"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/e5.10.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/e5.10.4"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/e5.8.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/e5.8.11"
}
],
"source": {
"advisory": "GHSA-cp9x-5qwc-fj6r",
"discovery": "UNKNOWN"
},
"title": "EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44725",
"datePublished": "2026-08-20T14:35:11.726Z",
"dateReserved": "2026-05-07T18:04:17.308Z",
"dateUpdated": "2026-08-21T21:47:37.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8741 (GCVE-0-2026-8741)
Vulnerability from nvd – Published: 2026-05-17 08:15 – Updated: 2026-05-18 17:53
VLAI
EPSS
VEX
Title
EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition
Summary
A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-18 16:43 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364329 | vdb-entry |
| https://vuldb.com/vuln/364329/cti | signaturepermissions-required |
| https://vuldb.com/submit/809931 | third-party-advisory |
| https://github.com/Pathfind-tama/Report_EMQX_MQTT | related |
| https://github.com/Pathfind-tama/Report_EMQX_MQTT… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T16:43:33.259533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:53:07.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:emqx:emqx:*:*:*:*:*:*:*:*"
],
"modules": [
"QoS 2 PUBLISH Packet Handler"
],
"product": "EMQX",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CCCaaa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T08:15:08.625Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364329 | EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364329"
},
{
"name": "VDB-364329 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364329/cti"
},
{
"name": "Submit #809931 | EMQX EMQX Broker EMQX 6.1.0 (confirmed) Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/809931"
},
{
"tags": [
"related"
],
"url": "https://github.com/Pathfind-tama/Report_EMQX_MQTT"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Pathfind-tama/Report_EMQX_MQTT/blob/main/MQTT%20QoS%202%20Message%20Duplication%20in%20Persistent%20Sessions.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T13:24:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8741",
"datePublished": "2026-05-17T08:15:08.625Z",
"dateReserved": "2026-05-16T11:19:08.422Z",
"dateUpdated": "2026-05-18T17:53:07.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52136 (GCVE-0-2025-52136)
Vulnerability from nvd – Published: 2025-08-10 00:00 – Updated: 2025-08-12 14:27 Disputed
VLAI
EPSS
VEX
Summary
In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-12 14:27 UTC
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52136",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-12T14:27:21.450060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T14:27:35.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ricardojoserf/emqx-RCE"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EMQX",
"vendor": "EMQX",
"versions": [
{
"lessThan": "5.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emqx:emqx:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier\u0027s position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin\u0027s acceptability (for later Dashboard installation) is set by the \"emqx ctl plugins allow\" CLI command."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-10T03:16:32.155Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/ricardojoserf/emqx-RCE"
},
{
"url": "https://docs.emqx.com/en/emqx/latest/dashboard/introduction.html"
},
{
"url": "https://docs.emqx.com/en/emqx/latest/deploy/install-docker.html"
}
],
"tags": [
"disputed"
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52136",
"datePublished": "2025-08-10T00:00:00.000Z",
"dateReserved": "2025-06-16T00:00:00.000Z",
"dateUpdated": "2025-08-12T14:27:35.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-37781 (GCVE-0-2023-37781)
Vulnerability from nvd – Published: 2023-07-17 00:00 – Updated: 2024-10-30 15:09
VLAI
EPSS
VEX
Summary
An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
Severity
No CVSS data available.
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 15:09 UTC
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:23:26.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/emqx/emqx/issues/10419"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37781",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T15:09:06.961092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T15:09:25.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-17T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/emqx/emqx/issues/10419"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-37781",
"datePublished": "2023-07-17T00:00:00.000Z",
"dateReserved": "2023-07-10T00:00:00.000Z",
"dateUpdated": "2024-10-30T15:09:25.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-46434 (GCVE-0-2021-46434)
Vulnerability from nvd – Published: 2022-03-28 11:10 – Updated: 2024-08-04 05:02 Unsupported When Assigned
VLAI
EPSS
VEX
Summary
EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/emqx/emqx/issues/6791 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:02:11.689Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/emqx/emqx/issues/6791"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "EMQ X Dashboard V3.0.0 is affected by username enumeration in the \"/api /v3/auth\" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-28T11:10:15.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/issues/6791"
}
],
"tags": [
"unsupported-when-assigned"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-46434",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** UNSUPPORTED WHEN ASSIGNED ** EMQ X Dashboard V3.0.0 is affected by username enumeration in the \"/api /v3/auth\" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/emqx/emqx/issues/6791",
"refsource": "MISC",
"url": "https://github.com/emqx/emqx/issues/6791"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-46434",
"datePublished": "2022-03-28T11:10:15.000Z",
"dateReserved": "2022-01-24T00:00:00.000Z",
"dateUpdated": "2024-08-04T05:02:11.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-44725 (GCVE-0-2026-44725)
Vulnerability from cvelistv5 – Published: 2026-08-20 14:35 – Updated: 2026-08-21 21:47
VLAI
EPSS
VEX
Title
EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
Summary
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:00 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/emqx/emqx/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/emqx/emqx/pull/17200 | x_refsource_MISC |
| https://github.com/emqx/emqx/pull/17201 | x_refsource_MISC |
| https://github.com/emqx/emqx/commit/2f926359fa847… | x_refsource_MISC |
| https://github.com/emqx/emqx/commit/efa1ca1bef151… | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.0.3 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.1.2 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/6.2.1 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/e5.10.4 | x_refsource_MISC |
| https://github.com/emqx/emqx/releases/tag/e5.8.11 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:00:30.568823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:47:37.335Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "emqx",
"vendor": "emqx",
"versions": [
{
"status": "affected",
"version": "\u003c 5.8.11"
},
{
"status": "affected",
"version": "\u003e= 5.9.0, \u003c 5.9.3"
},
{
"status": "affected",
"version": "\u003e= 5.10.0, \u003c 5.10.4"
},
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.0.3"
},
{
"status": "affected",
"version": "\u003e= 6.1.0, \u003c 6.1.2"
},
{
"status": "affected",
"version": "\u003e= 6.2.0, \u003c 6.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute grant lifetime or SHA-256 package binding. An attacker with a compromised dashboard administrator credential or API key with plugin-install permission who finds a stale allowed name and version can upload attacker-controlled bytes under the allowed .tar.gz filename through POST /api/v5/plugins/install or the dashboard plugin upload. The broker then installs and runs attacker-controlled Erlang code with the privileges of the EMQX process. This issue is fixed in versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672: Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:35:11.726Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/emqx/emqx/security/advisories/GHSA-cp9x-5qwc-fj6r"
},
{
"name": "https://github.com/emqx/emqx/pull/17200",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/pull/17200"
},
{
"name": "https://github.com/emqx/emqx/pull/17201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/pull/17201"
},
{
"name": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/commit/2f926359fa847dd9928a8e94d3e342f5621806f4"
},
{
"name": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/commit/efa1ca1bef1517f1f87e1d562f8db8750b6d6ce3"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.0.3"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.1.2"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/6.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/6.2.1"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/e5.10.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/e5.10.4"
},
{
"name": "https://github.com/emqx/emqx/releases/tag/e5.8.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/releases/tag/e5.8.11"
}
],
"source": {
"advisory": "GHSA-cp9x-5qwc-fj6r",
"discovery": "UNKNOWN"
},
"title": "EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44725",
"datePublished": "2026-08-20T14:35:11.726Z",
"dateReserved": "2026-05-07T18:04:17.308Z",
"dateUpdated": "2026-08-21T21:47:37.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8741 (GCVE-0-2026-8741)
Vulnerability from cvelistv5 – Published: 2026-05-17 08:15 – Updated: 2026-05-18 17:53
VLAI
EPSS
VEX
Title
EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition
Summary
A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-18 16:43 UTC
CWE
- CWE-362 - Race Condition
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/364329 | vdb-entry |
| https://vuldb.com/vuln/364329/cti | signaturepermissions-required |
| https://vuldb.com/submit/809931 | third-party-advisory |
| https://github.com/Pathfind-tama/Report_EMQX_MQTT | related |
| https://github.com/Pathfind-tama/Report_EMQX_MQTT… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8741",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-18T16:43:33.259533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-18T17:53:07.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:emqx:emqx:*:*:*:*:*:*:*:*"
],
"modules": [
"QoS 2 PUBLISH Packet Handler"
],
"product": "EMQX",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CCCaaa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in EMQX up to 6.2.0. This affects an unknown function of the file apps/emqx/src/emqx_persistent_session_ds.erl of the component QoS 2 PUBLISH Packet Handler. Such manipulation leads to race condition. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T08:15:08.625Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-364329 | EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/364329"
},
{
"name": "VDB-364329 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/364329/cti"
},
{
"name": "Submit #809931 | EMQX EMQX Broker EMQX 6.1.0 (confirmed) Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/809931"
},
{
"tags": [
"related"
],
"url": "https://github.com/Pathfind-tama/Report_EMQX_MQTT"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Pathfind-tama/Report_EMQX_MQTT/blob/main/MQTT%20QoS%202%20Message%20Duplication%20in%20Persistent%20Sessions.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-16T13:24:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8741",
"datePublished": "2026-05-17T08:15:08.625Z",
"dateReserved": "2026-05-16T11:19:08.422Z",
"dateUpdated": "2026-05-18T17:53:07.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-52136 (GCVE-0-2025-52136)
Vulnerability from cvelistv5 – Published: 2025-08-10 00:00 – Updated: 2025-08-12 14:27 Disputed
VLAI
EPSS
VEX
Summary
In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-12 14:27 UTC
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-52136",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-12T14:27:21.450060Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T14:27:35.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ricardojoserf/emqx-RCE"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EMQX",
"vendor": "EMQX",
"versions": [
{
"lessThan": "5.8.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:emqx:emqx:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier\u0027s position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin\u0027s acceptability (for later Dashboard installation) is set by the \"emqx ctl plugins allow\" CLI command."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-10T03:16:32.155Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/ricardojoserf/emqx-RCE"
},
{
"url": "https://docs.emqx.com/en/emqx/latest/dashboard/introduction.html"
},
{
"url": "https://docs.emqx.com/en/emqx/latest/deploy/install-docker.html"
}
],
"tags": [
"disputed"
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-52136",
"datePublished": "2025-08-10T00:00:00.000Z",
"dateReserved": "2025-06-16T00:00:00.000Z",
"dateUpdated": "2025-08-12T14:27:35.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-37781 (GCVE-0-2023-37781)
Vulnerability from cvelistv5 – Published: 2023-07-17 00:00 – Updated: 2024-10-30 15:09
VLAI
EPSS
VEX
Summary
An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file.
Severity
No CVSS data available.
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 15:09 UTC
CWE
- n/a
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:23:26.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/emqx/emqx/issues/10419"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37781",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T15:09:06.961092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T15:09:25.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in the emqx_sn plugin of EMQX v4.3.8 allows attackers to execute a directory traversal via uploading a crafted .txt file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-17T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/emqx/emqx/issues/10419"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-37781",
"datePublished": "2023-07-17T00:00:00.000Z",
"dateReserved": "2023-07-10T00:00:00.000Z",
"dateUpdated": "2024-10-30T15:09:25.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-46434 (GCVE-0-2021-46434)
Vulnerability from cvelistv5 – Published: 2022-03-28 11:10 – Updated: 2024-08-04 05:02 Unsupported When Assigned
VLAI
EPSS
VEX
Summary
EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/emqx/emqx/issues/6791 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:02:11.689Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/emqx/emqx/issues/6791"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "EMQ X Dashboard V3.0.0 is affected by username enumeration in the \"/api /v3/auth\" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-28T11:10:15.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/emqx/emqx/issues/6791"
}
],
"tags": [
"unsupported-when-assigned"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-46434",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** UNSUPPORTED WHEN ASSIGNED ** EMQ X Dashboard V3.0.0 is affected by username enumeration in the \"/api /v3/auth\" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/emqx/emqx/issues/6791",
"refsource": "MISC",
"url": "https://github.com/emqx/emqx/issues/6791"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-46434",
"datePublished": "2022-03-28T11:10:15.000Z",
"dateReserved": "2022-01-24T00:00:00.000Z",
"dateUpdated": "2024-08-04T05:02:11.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}