Security readout for executives and security teams
Plain-English summary
A malicious or compromised MQTT broker can abuse fragmented network traffic to make a Contiki-NG device overwrite memory. This can crash the device, expose data, or potentially execute code. MQTT traffic is plaintext in this implementation, increasing concern on untrusted networks. The supplied version information is insufficient to define the full affected range.
Executive priority
Prioritize identification and remediation of exposed Contiki-NG MQTT devices, especially operational or safety-relevant systems. Potential code execution and device disruption justify urgent action, but the reported high attack complexity and absence of documented active exploitation make immediate emergency shutdown unwarranted unless suspicious failures are already occurring.
Technical view
Persistent parser state across TCP segments can bypass the 64-byte topic-length guard in parse_publish_vhdr(). A later memcpy uses the unvalidated 16-bit length against a 65-byte buffer, corrupting adjacent structure fields, including a subsequently dereferenced pointer. Reported consequences include information disclosure, denial of service, and possible remote code execution on targets lacking memory protection.
Likely exposure
Exposure is most likely where embedded devices use Contiki-NG's MQTT client and communicate with attacker-controlled or compromised brokers. Plaintext MQTT also exposes connections to interference on untrusted networks. The bundle identifies Contiki-NG as affected but provides only version "0," so organizations must verify deployed source revisions rather than rely on that version field.
Exploitation context
The CVSS 4.0 score is 9.2, with network reachability, high attack complexity, no privileges, and no user interaction. The supplied sources do not establish active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation depends on specially segmented broker traffic and vulnerable persistent parser state.
Researcher notes
The flaw is a CWE-787 out-of-bounds write caused by incorrect ordering and persistence of topic_len_received. The adjacent payload_chunk pointer reportedly turns corruption into a powerful memory-write condition. Actual exploitability will vary by architecture, compiler layout, and memory protections. The supplied affected-version metadata is incomplete, so source-level verification is essential.
Mitigation direction
- Apply a vendor release containing commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d after compatibility testing.
- If no fixed release exists, assess backporting the referenced patch through the device vendor.
- Restrict devices to trusted MQTT brokers and tightly control broker administration.
- Isolate plaintext MQTT traffic on trusted networks until patched.
- Monitor vendor guidance for clarified affected versions and supported releases.
Validation and detection
- Inventory firmware using Contiki-NG and determine the exact mqtt.c source revision.
- Confirm whether commit a34a2dbdc8bea784bd2ae5079aa4be520cd74f2d is present.
- Review configurations for MQTT client use and broker destinations.
- Test the patched parser with oversized, segmented PUBLISH topics in an isolated environment.
- Monitor devices and brokers for unexplained MQTT-related crashes or resets.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-5857 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/contiki-ng/contiki-ngCVE reference, VulnCheck · product
- https://github.com/contiki-ng/contiki-ng/pull/3163CVE reference, VulnCheck · issue-tracking
- https://github.com/contiki-ng/contiki-ng/commit/a34a2dbdc8bea784bd2ae5079aa4be520cd74f2dCVE reference, VulnCheck · patch
- Blog PostCVE reference, VulnCheck · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.