CVSS: 9.8EPSS: 6%CPEs: 70EXPL: 0CVE-2019-12256
https://notcve.org/view.php?id=CVE-2019-12256
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options. Wind River VxWorks 6.9 y vx7 tiene un desbordamiento de búfer en el componente IPv4. Existe una vulnerabilidad de seguridad IPNET: desbordamiento de pila en el análisis de las opciones IP de los paquetes IPv4. • https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 https://security.netapp.com/advisory/ntap-20190802-0001 https://support.f5.com/csp/article/K41190253 https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12256 https://support2.windriver.com/index.php?page=security-notices&# • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.1EPSS: 0%CPEs: 50EXPL: 0CVE-2019-12264
https://notcve.org/view.php?id=CVE-2019-12264
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component. Wind River VxWorks versiones 6.6, 6.7, 6.8, 6.9.3, 6.9.4 y Vx7 tiene un control de acceso incorrecto en la asignación de IPv4 por el componente de cliente ipdhcpc DHCP. • https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf https://support.f5.com/csp/article/K41190253 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03960en_us https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12264 https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.3EPSS: 2%CPEs: 6EXPL: 0CVE-2015-7599
https://notcve.org/view.php?id=CVE-2015-7599
Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password. Desbordamiento de entero en la función _authenticate en svc_auth.c en Wind River VxWorks 5.5 hasta la versión 6.9.4.1, cuando el protocolo Remote Procedure Call (RPC) esta habilitado, permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de un nombre de usuario y contraseña. • http://blogs.windriver.com/wind_river_blog/2015/09/wind-river-vxworks-updateclarification.html http://www.securityfocus.com/bid/79205 https://kb.netapp.com/support/s/article/cve-2015-7599-vxworks-vulnerability-impacting-netapp-e-series-products?language=en_US https://security.netapp.com/advisory/ntap-20151029-0001 https://www.syscan360.org/slides/2015_EN_AttackingVxWorksFromstoneagetointerstellar_Eric_Yannick.pdf • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.8EPSS: 2%CPEs: 21EXPL: 0CVE-2015-3963
https://notcve.org/view.php?id=CVE-2015-3963
Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value. Vulnerabilidad en Wind River VxWorks en versiones anteriores a 5.5.1, 6.5.x hasta la versión 6.7.x en versiones anteriores a 6.7.1.1, 6.8.x hasta la versión 6.8.3, 6.9.x en versiones anteriores a 6.9.4.4 y 7.x en versiones anteriores a 7 ipnet_coreip 1.2.2.0, tal como se utiliza en dispositivos Schneider Electric SAGE RTU en versiones anteriores a J2 y otros dispositivos, no genera correctamente valores del número inicial de secuencia (ISN) de TCP, lo que hace que sea más fácil para los atacantes remotos falsificar las sesiones TCP al predecir un valor ISN. • http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01 http://www.securityfocus.com/bid/75302 http://www.securitytracker.com/id/1032730 http://www.securitytracker.com/id/1033181 https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01 https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A https://security.netapp.com/advisory/ntap-20160324-0001 • CWE-330: Use of Insufficiently Random Values •
CVSS: 10.0EPSS: 87%CPEs: 4EXPL: 0CVE-2010-2965
https://notcve.org/view.php?id=CVE-2010-2965
The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804. El servicio WDB target agent debug en Wind River VxWorks v6.x, v5.x, y anteriores, como los usados en el Rockwell Automation 1756-ENBT serie A con firmware v3.2.6 y v3.6.1 y otros productos, permiten a atacantes remotos leer o modificar a su elección direcciones de memoria, realizar llamdas a funciones, o administrar tareas a través de peticiones UDP al puerto 17185, relacionado con el comportamiento de CVE-2005-3804. • http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=69735 http://www.kb.cert.org/vuls/id/362332 http://www.kb.cert.org/vuls/id/MAPG-86EPFA http://www.kb.cert.org/vuls/id/MAPG-86FPQL https://support.windriver.com/olsPortal/faces/maintenance/downloadDetails.jspx?contentId=033708 • CWE-863: Incorrect Authorization •