A team from Florida International University has built SNFuzz, a fuzzing framework aimed at MQTT-SN, the lightweight messaging protocol that vehicles and roadside systems increasingly use for V2X communication. Their first run found a high-severity denial-of-service vulnerability in the EMQX gateway, which they reported to the developers.
MQTT-SN is a UDP-based variant of MQTT designed for low-power, resource-constrained devices. The team argues its stateless transport and gateway-centric design creates extra attack surface, because gateways maintain implicit protocol state that attackers never see.
Connection-oriented fuzzers miss this hidden logic entirely. SNFuzz instead tracks the states a gateway juggles and drives execution from server responses, letting it probe deep state-dependent paths. Against three MQTT-SN gateway implementations, it beat existing network fuzzers on state coverage and reached protocol branches earlier tools never touched.
The findings, presented at VehicleSec ’26, highlight a broader problem: state-aware fuzzing is becoming essential for gateway-centric IoT protocols running over stateless transports, and vehicles are no exception as they evolve into connected systems relying on lightweight messaging.
With V2X deployment expanding, flaws in the middleware that moves safety-critical messages between cars and infrastructure carry outsized risk. The team says its results show how automated fuzzing can surface these bugs before attackers do.
