Cesanta Mongoose MQTT SUBSCRIBE Denial of Service

An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose. To trigger this vulnerability, an attacker must send a specially crafted MQTT SUBSCRIBE packet over the network, without a preliminary CONNECT packet. Successful exploitation results in remote code execution or denial of service conditions of the application.