Description
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
URGENT/11 Scanner, Based on Detection Tool by Armis
auxiliary/scanner/vxworks/urgent11_check
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- VDE-2020-002 PHOENIX CONTACT: Advisory for multiple FL Switch GHS utilising VxWorks CERT@VDE · Jun 5, 2025
- ICSA-19-274-01 Interpeak IPnet TCP/IP Stack (Update E) CISA ICS & IT advisories · Sep 24, 2024
- ICSA-23-320-10 Siemens SIPROTEC 4 7SJ66 CISA ICS & IT advisories · Nov 14, 2023
- SSA-617233 SSA-617233: Urgent/11 TCP/IP Stack Vulnerabilities in SIPROTEC 4 7SJ66 Devices Siemens ProductCERT · Nov 14, 2023
- WID-SEC-2023-2884 Wind River VxWorks: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 13, 2023
- ICSMA-19-274-01 Interpeak IPnet TCP/IP Stack (Update D) CISA ICS & IT advisories · Jan 7, 2020
- ICSA-19-211-01 Wind River VxWorks (Update A) CISA ICS & IT advisories · Aug 8, 2019
References
- https://support2.windriver.com/index.php?page=security-notices
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
- https://security.netapp.com/advisory/ntap-20190802-0001/
- https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12258
- https://support.f5.com/csp/article/K41190253
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf