Eclipse Hono vulnerabilities

2 CVEs affecting Eclipse Hono, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-27220, published 2021-01-14.

More from Eclipse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-27217, published 2020-11-13. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the…
• CVE-2020-27220, published 2021-01-14. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a…