CVE-2026-13489

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13489", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-27T15:50:21.113Z", "datePublished": "2026-06-28T10:45:08.559Z", "dateUpdated": "2026-06-29T13:01:04.992Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-28T10:45:08.559Z"}, "title": "78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-662", "lang": "en", "description": "Improper Synchronization"}]}], "affected": [{"vendor": "78", "product": "xiaozhi-esp32", "versions": [{"version": "2.2.0", "status": "affected"}, {"version": "2.2.1", "status": "affected"}, {"version": "2.2.2", "status": "affected"}, {"version": "2.2.3", "status": "affected"}, {"version": "2.2.4", "status": "affected"}, {"version": "2.2.5", "status": "affected"}, {"version": "2.2.6", "status": "affected"}], "cpes": ["cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"], "modules": ["MCP Response Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-27T17:55:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "dem0000 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/374486", "name": "VDB-374486 | 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374486/cti", "name": "VDB-374486 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13489", "name": "CVE-2026-13489 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/838198", "name": "Submit #838198 | 78 xiaozhi-esp32 36200942cca3f7cbac6c927ce7458bad874297ab Information Exposure / Improper Routing", "tags": ["third-party-advisory"]}, {"url": "https://github.com/78/xiaozhi-esp32/issues/2020", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/78/xiaozhi-esp32/pull/2021", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/78/xiaozhi-esp32/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-29T13:00:53.902441Z", "id": "CVE-2026-13489", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:01:04.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13489", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:00:53.902441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:00:59.659Z"}}], "cna": {"title": "78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization", "credits": [{"lang": "en", "type": "reporter", "value": "dem0000 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"], "vendor": "78", "modules": ["MCP Response Handler"], "product": "xiaozhi-esp32", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}]}], "timeline": [{"lang": "en", "time": "2026-06-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-27T17:55:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/374486", "name": "VDB-374486 | 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374486/cti", "name": "VDB-374486 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13489", "name": "CVE-2026-13489 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/838198", "name": "Submit #838198 | 78 xiaozhi-esp32 36200942cca3f7cbac6c927ce7458bad874297ab Information Exposure / Improper Routing", "tags": ["third-party-advisory"]}, {"url": "https://github.com/78/xiaozhi-esp32/issues/2020", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/78/xiaozhi-esp32/pull/2021", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/78/xiaozhi-esp32/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "Improper Synchronization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-28T10:45:08.559Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13489", "state": "PUBLISHED", "dateUpdated": "2026-06-29T13:01:04.992Z", "dateReserved": "2026-06-27T15:50:21.113Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-28T10:45:08.559Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"], "modules": ["MCP Response Handler"], "product": "xiaozhi-esp32", "vendor": "78", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha identificado una debilidad en 78 xiaozhi-esp32 hasta la versi\u00f3n 2.2.6. Afectada por este problema es la funci\u00f3n ParseMessage del archivo main/mcp_server.cc del componente Gestor de Respuesta MCP. Esta manipulaci\u00f3n causa una sincronizaci\u00f3n incorrecta. La explotaci\u00f3n remota del ataque es posible. La complejidad del ataque se califica como alta. Se sabe que la explotaci\u00f3n es dif\u00edcil. El exploit se ha puesto a disposici\u00f3n del p\u00fablico y podr\u00eda usarse para ataques. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada."}], "id": "CVE-2026-13489", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13489", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-29T13:00:53.902441Z", "version": "2.0.3"}}]}, "published": "2026-06-28T12:17:03.170", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/78/xiaozhi-esp32/"}, {"source": "cna@vuldb.com", "url": "https://github.com/78/xiaozhi-esp32/issues/2020"}, {"source": "cna@vuldb.com", "url": "https://github.com/78/xiaozhi-esp32/pull/2021"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-13489"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/838198"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/374486"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/374486/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-662"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "xiaozhi-esp32", "source": "cna", "vendor": "78"}, "product": "xiaozhi-esp32", "vendor": "78"}], "created": "2026-06-28T13:30:06.776748+00:00", "updated": "2026-06-28T16:15:03.928192+00:00", "vendors": ["78", "78$PRODUCT$xiaozhi-esp32"]}