CVE-2026-13491
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk33th percentile — higher than 33% of all known CVEs
Summary
A vulnerability was found in the MQTT Goodbye Handler component in file main/protocols/mqtt_protocol.cc of xiaozhi-esp32 up to version 2.2.6. Manipulation of the session_id argument in the Application::GetInstance function leads to a denial of service. The attack is remote but requires high complexity.
Risk Assessment
The organization faces the risk of remote disruption of IoT devices based on xiaozhi-esp32, potentially causing service outages and requiring manual recovery.
Recommendation
Apply the patch with ID e182471f8c5a22434346bd98da34d3b66c8c8b3e immediately to fix this vulnerability. Updating to the latest software version is recommended.
Original NVD description (English source)
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.