High severity · published Nov 18, 2024
CVE-2024-42385
Improper Neutralization of Delimiters in Mongoose Web Server library
7.0
CVSS
0.1%
EPSS
No
On KEV
Description
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mongoose Web Server · Cesanta
through 7.14 · source: vendor
MO
Mongoose · Cesanta
through 7.14 · source: NVD
R7
Reyrolle 7SR5 · Siemens
before V2.70 · source: CISA
In the news
VulnerabilityCritical
Siemens Reyrolle 7SR5
View CSAF Summary Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version. The following versions of Siemens Reyrolle 7SR5 are affected: Reyrolle 7SR5 vers:intdot/<2.70 (CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653, CVE-2026-62654) CVSS Vendor Equipment Vulnerabilities v3 9.8 Siemens Siemens Reyrolle 7SR5 Integer Overflow or Wraparound, Improper Neutralization of Delimiters, Use of Out-of-range Pointer Offset, Missing Authentication for Critical Function, Insufficient Entropy, Improper Input Validation, Out-of-bounds Write, Allocation of Resources Without Limits or Throttling, Authentication Bypass Using an Alternate Path or Channel, Insertion of Sensitive Information Into Debugging Code, Download of Code Without Integrity Check Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2024-42384 Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. View CVE Details ...
Sep 15, 2026·CISA Advisories
Affected product
MW
Mongoose Web Server
Cesanta
More from Mongoose Web Server
9.8
CVE-2024-42383
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2018-25193
Mongoose Web Server 6.9 Denial of Service via Socket Connection
7.5
CVE-2024-42392
Improper Neutralization of Delimiters in Mongoose Web Server library
7.5
CVE-2024-42386
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2024-42384
Integer Overflow or Wraparound in Mongoose Web Server library