Riskcovery

CVE-2026-13491

78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service

State
Published
Severity
6.3 Medium
Published
Jun 28, 2026
Updated
Jun 29, 2026
Reserved
Jun 27, 2026

Read the record on cve.org

Description

A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CVulDB
3.03.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CVulDB
2.02.6 LowAV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
xiaozhi-esp3278
  • 2.2.0Affected
  • 2.2.1Affected
  • 2.2.2Affected
  • 2.2.3Affected
  • 2.2.4Affected
  • 2.2.5Affected
  • 2.2.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.