Xiaozhi Esp32
Approved changes feed: RSS · Atom
cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | 78 (203a263e-d352-5f15-9987-488b5f24cfb9) |
|---|---|
| Product | Xiaozhi Esp32 (0b6371c9-6a5c-5ef7-98f3-3eaa28eb0567) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13491 |
vulnerable | 2026-07-29 00:23:33.094383 |
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
LOW (3.7)
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.
Published: 2026-06-28T11:15:10.481Z
Updated: 2026-06-29T12:29:15.720Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13489 |
vulnerable | 2026-07-29 00:23:33.093029 |
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
LOW (3.1)
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Published: 2026-06-28T10:45:08.559Z
Updated: 2026-06-29T13:01:04.992Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.