CVE-2020-24338 is a critical vulnerability in picoTCP through version 1.7.0, affecting products like Altran picoTCP. It stems from improper validation of DNS compression pointer offsets, leading to out-of-bounds writes. This flaw carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and potential for Denial-of-Service and Remote Code Execution. While not listed in CISA KEV and lacking public exploit code in Metasploit, Nuclei, or ExploitDB, it has garnered some community discussion and media coverage as part of the "AMNESIA:33" vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.7.0CPE matchmatch criteria | cpe:2.3:a:altran:picotcp:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.