CVE-2025-66217
📋 TL;DR
An integer underflow vulnerability in AIS-catcher's MQTT parsing allows attackers to trigger heap buffer overflow via malformed packets. This can cause denial of service and potentially remote code execution when used as a library. All AIS-catcher installations prior to version 0.64 are affected.
💻 Affected Systems
- AIS-catcher
📦 What is this software?
Ais Catcher by Aiscatcher
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise when AIS-catcher is used as a library component.
Likely Case
Denial of service causing AIS-catcher service crashes and disruption of AIS data collection.
If Mitigated
Limited to service disruption if proper network segmentation and input validation are in place.
🎯 Exploit Status
Exploitation requires sending malformed MQTT packets with manipulated Topic Length field.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.64
Vendor Advisory: https://github.com/jvde-github/AIS-catcher/security/advisories/GHSA-93mj-c8q3-69rg
Restart Required: Yes
Instructions:
1. Download AIS-catcher version 0.64 or later from GitHub. 2. Stop the AIS-catcher service. 3. Replace the binary with the patched version. 4. Restart the service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict MQTT port access to trusted sources only
iptables -A INPUT -p tcp --dport 1883 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
Disable MQTT
allDisable MQTT functionality if not required
Edit configuration to remove or comment MQTT settings
🧯 If You Can't Patch
- Implement strict network access controls to limit MQTT traffic to trusted sources only.
- Deploy intrusion detection/prevention systems to monitor for malformed MQTT packets.
🔍 How to Verify
Check if Vulnerable:
Check AIS-catcher version: ais-catcher --version. If version is below 0.64, system is vulnerable.Check Version:
ais-catcher --versionVerify Fix Applied:
Verify version is 0.64 or higher and test MQTT functionality with valid packets.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in AIS-catcher logs
- Unexpected service restarts
- Memory allocation errors
Network Indicators:
- MQTT packets with unusually large Topic Length values
- Multiple malformed MQTT connection attempts
SIEM Query:
source="ais-catcher.log" AND ("segmentation fault" OR "buffer overflow" OR "SIGSEGV")