CVE-2026-13491: xiaozhi-esp32 MQTT Denial-of-Service Vulnerability (Public Exploit)

Technical summary

The flaw resides in main/protocols/mqtt_protocol.cc, specifically in the MQTT Goodbye Handler component's Application::GetInstance function. Improper validation or handling of the session_id argument during MQTT message processing allows an unauthenticated remote attacker to craft a malformed request that causes the application to enter an unrecoverable state or crash. The attack vector is network-based, requires no privileges, but involves high attack complexity due to specific preconditions or environmental factors that must align. The vulnerability is categorized under CWE-404 (Improper Resource Validation).

Business impact

Devices running vulnerable xiaozhi-esp32 firmware are susceptible to service disruption, which could render IoT or embedded systems unresponsive or offline. If xiaozhi-esp32 powers critical IoT deployments—such as smart home hubs, industrial controllers, or networked edge devices—an attacker could launch a denial-of-service attack to disrupt normal operations. The low CVSS score and difficult exploitability reduce the likelihood of widespread attacks, but the public availability of exploit code warrants proactive patching in security-sensitive environments.

Affected systems

All xiaozhi-esp32 installations running version 2.2.6 and earlier are affected. Organizations deploying xiaozhi-esp32-based IoT devices should audit their firmware versions and inventory systems still on vulnerable builds. The ESP32 is a widely-used microcontroller in consumer and industrial IoT products, so the scope of affected devices could be substantial if xiaozhi-esp32 is a popular firmware choice in your ecosystem.

Exploitability

The vulnerability is remotely exploitable without authentication or user interaction, but exploitability is classified as difficult due to high attack complexity. This typically means the attacker must satisfy specific environmental or timing conditions—for example, sending the malformed session_id while the MQTT handler is in a particular state, or having knowledge of valid session identifiers. Public exploit code is now available, reducing the barrier for actors with moderate skill, but the complexity requirement makes mass exploitation unlikely. Nonetheless, targeted attacks against known deployments remain plausible.

Remediation

Update xiaozhi-esp32 to a patched version beyond 2.2.6. The official patch is identified by commit hash e182471f8c5a22434346bd98da34d3b66c8c8b3e. Verify that your deployment includes this commit or a release tag that incorporates it. If automatic over-the-air (OTA) updates are available through your device manufacturer or firmware distributor, apply them promptly. For air-gapped or legacy deployments, plan a controlled rollout of patched firmware.

Patch guidance

Obtain the latest xiaozhi-esp32 release from the official repository and confirm it includes commit e182471f8c5a22434346bd98da34d3b66c8c8b3e or later. Test the patched firmware in a staging environment before wide deployment. Review the release notes for any breaking changes or dependencies. If you maintain a custom build, cherry-pick the fix from the commit hash or merge the latest upstream version. Document the patching activity and version deployed for compliance and audit purposes.

Detection guidance

Monitor network traffic for unusual or malformed MQTT messages, particularly those with unexpected or oversized session_id values. Enable logging on MQTT endpoints to capture connection attempts and disconnections. Watch for patterns of repeated connection failures or unexpected service restarts on devices running xiaozhi-esp32. Implement network segmentation to restrict MQTT traffic to trusted sources. Intrusion detection systems may flag crafted MQTT payloads if signatures are available; consult your IDS vendor for updates. Most importantly, compare running firmware versions against the patch commit to confirm remediation status.

Why prioritize this

Although the CVSS score is low (3.7) and the vulnerability is not on the CISA Known Exploited Vulnerabilities list, the combination of public exploit availability, network-based attack vector, and potential for service disruption in IoT environments warrants medium prioritization. Organizations with customer-facing or mission-critical IoT deployments should patch sooner; those with isolated or non-critical xiaozhi-esp32 devices can deprioritize slightly. The high attack complexity reduces urgency compared to easier-to-exploit flaws.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects a Low severity vulnerability: network-accessible (AV:N), no authentication required (PR:N), high complexity (AC:H), and limited impact—denial of service only (A:L), with no confidentiality or integrity loss (C:N, I:N). The score appropriately captures that while remote attack is possible, specific conditions must be met and only service availability is at risk. However, the public availability of exploits and the IoT context elevate practical risk slightly above the numerical score alone would suggest.

Frequently asked questions