CVE-2020-13987 is an Out-of-Bounds Read vulnerability in the uIP TCP/IP Stack, specifically within the upper_layer_chksum function in net/ipv4/uip.c, affecting Contiki OS and other products utilizing the uIP stack like Siemens devices and open-iscsi_project. This vulnerability carries a CVSS score of 7.5 (High), indicating it can be exploited remotely with low attack complexity, potentially leading to a denial of service. While there are no known public exploits (Metasploit, Nuclei, ExploitDB) or evidence of active exploitation (KEV: No, Hot List: Inactive), it has garnered some community attention and media coverage, notably in a Siemens advisory regarding embedded TCP/IP stack vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.0CPE matchmatch criteria | cpe:2.3:a:uip_project:uip:*:*:*:*:*:*:*:* | ||
<= 2.1.12CPE matchmatch criteria | cpe:2.3:a:open-iscsi_project:open-iscsi:*:*:*:*:*:*:*:* | ||
< 4.4.1CPE matchmatch criteria | cpe:2.3:o:siemens:sentron_3va_com100_firmware:*:*:*:*:*:*:*:* | ||
< 4.4.1CPE matchmatch criteria | cpe:2.3:o:siemens:sentron_3va_com800_firmware:*:*:*:*:*:*:*:* | ||
< 2.4.7CPE matchmatch criteria | cpe:2.3:o:siemens:sentron_pac3200_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.