Skip to content
OpenAdvisories
Critical ICSA-19-211-01 11 CVEs

Wind River VxWorks (Update A)

Published Jul 30, 2019 · Updated Aug 8, 2019 · Revision 2

Vendor: Wind River Systems Product: Advanced Networking Technology (ANT) Product: VxWorks Product: VxWorks 653 Product: VxWorks 7 Product: VxWorks bootrom network stack Product: VxWorks Cert Product: VxWorks End-of-Life Product: VxWorks Vx7

Summary

Successful exploitation of these vulnerabilities could allow remote code execution.

Vulnerabilities 11

  • Unscored —
    CVE-2019-12255 Public exploit EPSS 75%

    Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: T…

  • Unscored —
    CVE-2019-12256 EPSS 27%

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: S…

  • Unscored —
    CVE-2019-12257 EPSS 84%

    Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulne…

  • Unscored —
    CVE-2019-12258 Public exploit EPSS 23%

    Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: D…

  • Unscored —
    CVE-2019-12259 EPSS 16%

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNE…

  • Unscored —
    CVE-2019-12260 EPSS 23%

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vul…

  • Unscored —
    CVE-2019-12261

    Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET s…

  • Unscored —
    CVE-2019-12262

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security v…

  • Unscored —
    CVE-2019-12263

    Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security …

  • Unscored —
    CVE-2019-12264

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc …

  • Unscored —
    CVE-2019-12265 EPSS 60%

    Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IP…

Revision history

  1. #2

    Update A - Added advisory references for Schneider Electric and Dräger

  2. #1

    Initial Publication

References