NetX Duo MQTT Client Packet Exhaustion Vulnerability

Executive Summary

This vulnerability involves the NetX Duo MQTT client leaking packets carrying malformed PUBLISH messages. Each malformed message consumes one packet or chain of packets from the network driver's receive pool without returning it. Repeated attacks can exhaust the pool, halting all inbound network traffic until the device is rebooted.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for malformed MQTT PUBLISH messages that exhaust the network driver's receive pool. Use network sniffing tools like tcpdump or Wireshark to capture and analyze MQTT traffic for malformed packets. Check device logs for unusual packet exhaustion or network traffic drops. Monitor memory pools on affected devices for abnormal depletion.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disrupt network communication on the affected device by sending a few dozen malformed messages. This could lead to denial of service, preventing the device from receiving any inbound traffic until rebooted.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the NetX Duo MQTT client to the latest patched version. Implement network traffic filtering to block malformed MQTT PUBLISH messages at the firewall or network gateway. Restrict MQTT traffic to trusted sources only. Reboot affected devices to clear the exhausted packet pool if the issue is already occurring.

Useful 0 Not Useful 0