CVE-2017-9132

A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access Points before 2.2.3. These devices run Mosquitto, a lightweight message broker, to send information between devices. By using the vendor's hard-coded credentials to connect to the broker on any device (whether it be an AP, Client, or Backhaul model), an attacker can view all the messages being sent between the devices. If an attacker connects to an AP, the AP will leak information about any clients connected to it, including the serial numbers, which can be used to remotely factory reset the clients via a page in their web interface.

• CWE-798

• http://blog.iancaling.com/post/160596244178Third Party Advisory
• http://blog.iancaling.com/post/160596244178Third Party Advisory

Published

May 21, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-9126The quicktime_read_dref_table function in dref.c in libquick…
• CVE-2017-9127The quicktime_user_atoms_read_atom function in useratoms.c i…
• CVE-2017-9128The quicktime_video_width function in lqt_quicktime.c in lib…
• CVE-2017-9129The wav_open_read function in frontend/input.c in Freeware A…
• CVE-2017-9130The faacEncOpen function in libfaac/frame.c in Freeware Adva…5.5
• CVE-2017-9131An issue was discovered on Mimosa Client Radios before 2.2.3…
• CVE-2017-9133An issue was discovered on Mimosa Client Radios before 2.2.3…
• CVE-2017-9134An information-leakage issue was discovered on Mimosa Client…
• CVE-2017-9135An issue was discovered on Mimosa Client Radios before 2.2.4…
• CVE-2017-9136An issue was discovered on Mimosa Client Radios before 2.2.3…
• CVE-2017-9137Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a d…
• CVE-2017-9138There is a debug-interface vulnerability on some Tenda route…