CVE-2024-42655

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jul 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-426577.5An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encry CVE-2024-426589.8An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's para CVE-2024-42667.5The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Ex CVE-2024-426627.5An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.CVE-2024-42679.8A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. Th CVE-2024-426716.1A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicio CVE-2024-426768.8File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary cod CVE-2024-426775.5An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /n CVE-2024-426786.1Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrar CVE-2024-426797.8SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code CVE-2024-42685.4The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in a CVE-2024-426805.5An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by enterin