9.8
CRITICAL
CVE-2019-12255
VxWorks TCP/IP Buffer Overflow Vulnerability
Description

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.

INFO

Published Date :

Aug. 9, 2019, 8:15 p.m.

Last Modified :

Nov. 21, 2024, 4:22 a.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2019-12255 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2019-12255 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Belden hirschmann_hios
2 Belden garrettcom_magnum_dx940e_firmware
3 Belden hirschmann_ees20
4 Belden hirschmann_ees25
5 Belden hirschmann_eesx20
6 Belden hirschmann_eesx30
7 Belden hirschmann_grs1020
8 Belden hirschmann_grs1030
9 Belden hirschmann_grs1042
10 Belden hirschmann_grs1120
11 Belden hirschmann_grs1130
12 Belden hirschmann_grs1142
13 Belden hirschmann_msp30
14 Belden hirschmann_msp32
15 Belden hirschmann_rail_switch_power_lite
16 Belden hirschmann_rail_switch_power_smart
17 Belden hirschmann_red25
18 Belden hirschmann_rsp20
19 Belden hirschmann_rsp25
20 Belden hirschmann_rsp30
21 Belden hirschmann_rsp35
22 Belden hirschmann_rspe30
23 Belden hirschmann_rspe32
24 Belden hirschmann_rspe35
25 Belden hirschmann_rspe37
26 Belden hirschmann_msp40
27 Belden hirschmann_octopus_os3
28 Belden hirschmann_dragon_mach4000
29 Belden hirschmann_dragon_mach4500
30 Belden hirschmann_eagle_one
31 Belden hirschmann_eagle20
32 Belden hirschmann_eagle30
33 Belden garrettcom_magnum_dx940e
1 Siemens ruggedcom_win7000_firmware
2 Siemens ruggedcom_win7018_firmware
3 Siemens ruggedcom_win7025_firmware
4 Siemens ruggedcom_win7200_firmware
5 Siemens siprotec_5_firmware
6 Siemens power_meter_9410_firmware
7 Siemens power_meter_9810_firmware
8 Siemens ruggedcom_win7000
9 Siemens ruggedcom_win7200
10 Siemens ruggedcom_win7018
11 Siemens ruggedcom_win7025
12 Siemens siprotec_5
13 Siemens power_meter_9410
14 Siemens power_meter_9810
15 Siemens siprotec_5
1 Windriver vxworks
1 Sonicwall sonicos
1 Netapp e-series_santricity_os_controller
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2019-12255.

URL Resource
http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html Exploit Third Party Advisory VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190802-0001/ Third Party Advisory
https://support.f5.com/csp/article/K41190253 Third Party Advisory
https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255 Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices Issue Tracking Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ Vendor Advisory
http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html Exploit Third Party Advisory VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190802-0001/ Third Party Advisory
https://support.f5.com/csp/article/K41190253 Third Party Advisory
https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255 Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices Issue Tracking Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 2 months, 2 weeks ago
34 stars 3 fork 3 watcher
Born at : March 12, 2021, 12:22 p.m. This repo has been linked 1063 different CVEs too.

None

Updated: 3 months ago
19 stars 10 fork 10 watcher
Born at : Jan. 2, 2021, 10:19 p.m. This repo has been linked 1052 different CVEs too.

None

Updated: 3 weeks, 4 days ago
86 stars 33 fork 33 watcher
Born at : Oct. 2, 2020, 2:49 p.m. This repo has been linked 1113 different CVEs too.

Suricata LUA scripts to detect CVE-2019-12255, CVE-2019-12256, CVE-2019-12258, and CVE-2019-12260

Lua

Updated: 4 months, 1 week ago
19 stars 5 fork 5 watcher
Born at : Nov. 12, 2019, 8:43 p.m. This repo has been linked 4 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2019-12255 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2019-12255 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
    Added Reference https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
    Added Reference https://security.netapp.com/advisory/ntap-20190802-0001/
    Added Reference https://support.f5.com/csp/article/K41190253
    Added Reference https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS
    Added Reference https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255
    Added Reference https://support2.windriver.com/index.php?page=security-notices
    Added Reference https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS [No types assigned]
    Removed Reference MITRE https://support.f5.com/csp/article/K41190253?utm_source=f5support&utm_medium=RSS
  • Reanalysis by [email protected]

    Jun. 16, 2022

    Action Type Old Value New Value
    Added CPE Configuration AND OR *cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* versions up to (including) 07.0.07 OR cpe:2.3:h:belden:hirschmann_ees20:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_ees25:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_eesx20:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_eesx30:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1020:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1030:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1042:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1120:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1130:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_grs1142:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_msp30:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_msp32:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_red25:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rsp20:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rsp25:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rsp30:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rsp35:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rspe30:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rspe32:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rspe35:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_rspe37:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* versions up to (including) 07.5.01 OR cpe:2.3:h:belden:hirschmann_msp40:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_octopus_os3:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* versions up to (including) 07.2.04 OR cpe:2.3:h:belden:hirschmann_dragon_mach4000:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_dragon_mach4500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* versions up to (including) 05.3.06 OR cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:* cpe:2.3:h:belden:hirschmann_eagle_one:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:belden:garrettcom_magnum_dx940e_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.0.1_y7 OR cpe:2.3:h:belden:garrettcom_magnum_dx940e:-:*:*:*:*:*:*:*
  • Modified Analysis by [email protected]

    Feb. 10, 2022

    Action Type Old Value New Value
    Removed CVSS V3 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf Third Party Advisory
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf Third Party Advisory
    Changed Reference Type https://support.f5.com/csp/article/K41190253?utm_source=f5support&utm_medium=RSS No Types Assigned https://support.f5.com/csp/article/K41190253?utm_source=f5support&utm_medium=RSS Third Party Advisory
    Removed CWE NIST CWE-787
    Removed CWE NIST CWE-191
    Added CWE NIST CWE-120
    Changed CPE Configuration OR *cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* versions from (including) 6.6 up to (including) 6.9 OR *cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* versions from (including) 6.5 up to (excluding) 6.9.4
    Changed CPE Configuration OR *cpe:2.3:o:netap:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 8.00 up to (including) 8.40.50.00 OR *cpe:2.3:o:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 8.00 up to (including) 8.40.50.00
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:power_meter_9410_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.2.1 OR cpe:2.3:h:siemens:power_meter_9410:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:power_meter_9810_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:siemens:power_meter_9810:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:* versions up to (excluding) bs5.2.461.17 OR cpe:2.3:h:siemens:ruggedcom_win7000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:* versions up to (excluding) bs5.2.461.17 OR cpe:2.3:h:siemens:ruggedcom_win7018:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:* versions up to (excluding) bs5.2.461.17 OR cpe:2.3:h:siemens:ruggedcom_win7025:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:* versions up to (excluding) bs5.2.461.17 OR cpe:2.3:h:siemens:ruggedcom_win7200:-:*:*:*:*:*:*:*
  • CWE Remap by [email protected]

    Jul. 21, 2021

    Action Type Old Value New Value
    Changed CWE CWE-119 CWE-191 CWE-787
  • CVE Modified by [email protected]

    May. 12, 2020

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 09, 2019

    Action Type Old Value New Value
    Added Reference https://support.f5.com/csp/article/K41190253?utm_source=f5support&utm_medium=RSS [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 02, 2019

    Action Type Old Value New Value
    Changed Description Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow. Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
  • CVE Modified by [email protected]

    Sep. 10, 2019

    Action Type Old Value New Value
    Added Reference https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf [No Types Assigned]
  • Initial Analysis by [email protected]

    Aug. 19, 2019

    Action Type Old Value New Value
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
    Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html No Types Assigned http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html Exploit, Third Party Advisory, VDB Entry
    Changed Reference Type https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf No Types Assigned https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Third Party Advisory
    Changed Reference Type https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 No Types Assigned https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 Third Party Advisory
    Changed Reference Type https://security.netapp.com/advisory/ntap-20190802-0001/ No Types Assigned https://security.netapp.com/advisory/ntap-20190802-0001/ Third Party Advisory
    Changed Reference Type https://support.f5.com/csp/article/K41190253 No Types Assigned https://support.f5.com/csp/article/K41190253 Third Party Advisory
    Changed Reference Type https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255 No Types Assigned https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255 Vendor Advisory
    Changed Reference Type https://support2.windriver.com/index.php?page=security-notices No Types Assigned https://support2.windriver.com/index.php?page=security-notices Issue Tracking, Vendor Advisory
    Changed Reference Type https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ No Types Assigned https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ Vendor Advisory
    Added CWE CWE-119
    Added CPE Configuration OR *cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* versions from (including) 6.6 up to (including) 6.9
    Added CPE Configuration OR *cpe:2.3:o:netap:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from (including) 8.00 up to (including) 8.40.50.00
    Added CPE Configuration OR *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 5.9.0.0 up to (including) 5.9.0.7 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 5.9.1.0. up to (including) 5.9.1.12 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.0.0 up to (including) 6.2.3.1 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.4.0 up to (including) 6.2.4.3 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.5.0 up to (including) 6.2.5.3 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.6.0 up to (including) 6.2.6.1 *cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:* *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.7.0 up to (including) 6.2.7.4 *cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:* *cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:* *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.2.9.0 up to (including) 6.2.9.2 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.5.0.0 up to (including) 6.5.0.3 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.5.1.0 up to (including) 6.5.1.4 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.5.2.0 up to (including) 6.5.2.3 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.5.3.0 up to (including) 6.5.3.3 *cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from (including) 6.5.4.0. up to (including) 6.5.4.3
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300 versions up to (excluding) 7.91 OR cpe:2.3:h:siemens:siprotec_5:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp200 OR cpe:2.3:o:siemens:siprotec_5:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300 OR cpe:2.3:o:siemens:siprotec_5:-:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Aug. 16, 2019

    Action Type Old Value New Value
    Added Reference https://support.f5.com/csp/article/K41190253 [No Types Assigned]
  • CVE Modified by [email protected]

    Aug. 15, 2019

    Action Type Old Value New Value
    Changed Description Wind River VxWorks 6.5 through 6.9.3 has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow. Affected versions: 6.6, 6.7, 6.8, 6.9 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
  • CVE Modified by [email protected]

    Aug. 12, 2019

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html [No Types Assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2019-12255 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

63.66 }} -19.74%

score

0.98001

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability