Butok maintains a focused embedded-systems product portfolio centered on its FNET networking stack, which appears in industrial and real-time control applications where memory safety and cryptographic robustness are critical. Its vulnerabilities skew strongly toward critical-severity outcomes and concentrate in weakness classes including out-of-bounds reads, weak random-value generation, and uninitialized pointer access—flaws characteristic of low-level systems code operating in resource-constrained environments. Defenders deploying FNET-based devices should prioritize inventory and vendor patching guidance; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Butok over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-24383CRITICAL An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check for proper '\0' termination of the resource record name string | Dec 11, 2020 | 9.1 | 31 | NO | NO |
CVE-2020-27633CRITICAL In FNET 4.6.3, TCP ISNs are improperly random. | Oct 10, 2023 | 9.1 | 26 | NO | NO |
CVE-2020-17469HIGH An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment starting from a network incoming fragment that still doesn' | Dec 11, 2020 | 7.5 | 24 | NO | NO |
CVE-2020-17468HIGH An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check for a valid length of an extension header | Dec 11, 2020 | 7.5 | 23 | NO | NO |
CVE-2020-17467CRITICAL An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\0' termination. Therefore, the deduced length of the h | Dec 11, 2020 | 9.1 | 23 | NO | NO |
CVE-2020-17470MEDIUM An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to | Dec 11, 2020 | 5.3 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Butok.
Media articles that mention a CVE ID that affects a product developed by Butok — matched by CVE ID, not by vendor name.