Read the docs

chirpstack

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

chirpstack records in CISA KEV

No chirpstack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Gateway Bridge 1 record MEDIUM Mqtt Forwarder 1 record MEDIUM Network Server 1 record LOW

Records

3 records

TI-2024-19632 CVE-2024-29862 · GHSA-35c8-rp3m-p5v6

The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and…

Priority MEDIUM 40

The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00651 Published 2024-03-21 No fix listed
TI-2020-17196 CVE-2020-28349 · GHSA-xrpw-hmf5-ch3x

An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a…

Priority LOW 33

An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/upli…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02201 Published 2020-11-09 No fix listed CWE-20
TI-2026-49949 CVE-2026-71282 · GHSA-9g5q-g36m-7qqq

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

Priority LOW 29

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while onl…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00386 Published 2026-08-05 No fix listed CWE-89
Open these records in search →