CVE-2019-12257 is a critical heap overflow vulnerability in the DHCP client component of Wind River VxWorks versions 6.6 through 6.9, impacting products from vendors like Belden, NetApp, Siemens, and SonicWall. With a CVSS score of 8.8 (High), this vulnerability allows an unauthenticated attacker on the adjacent network to achieve high confidentiality, integrity, and availability impacts with low attack complexity. While not listed in CISA's KEV catalog and lacking public exploit code in Metasploit or ExploitDB, it has garnered significant community discussion and media coverage, indicating high awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.5, < 6.9.4CPE matchmatch criteria | cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* | ||
>= 5.9.0.0, <= 5.9.0.7CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | ||
>= 5.9.1.0., <= 5.9.1.12CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | ||
>= 6.2.0.0, <= 6.2.3.1CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | ||
>= 6.2.4.0, <= 6.2.4.3CPE matchmatch criteria | cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
VxWorks security updates in Bosch Rexroth controllers
Aug 8, 2019VxWorks security updates in Bosch Rexroth controllers
Aug 8, 2019VxWorks security updates in Bosch Rexroth controllers
Aug 8, 2019VxWorks security updates in Bosch Rexroth controllers
Aug 8, 2019VxWorks security updates in Bosch Rexroth controllers
Aug 8, 2019