High severity · published Aug 5, 2019
CVE-2019-12264
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component
7.1
CVSS
8.3%
EPSS
No
On KEV
Description
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.3% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GM
Garrettcom Magnum Dx940e Firmware · Belden
through 1.0.1_y7 · source: NVD
HH
Hirschmann Hios · Belden
through 07.0.07; through 07.5.01; through 07.2.04; through 05.3.06 · source: NVD
RW
Ruggedcom Win7000 Firmware · Siemens
before bs5.2.461.17 · source: NVD
RW
Ruggedcom Win7018 Firmware · Siemens
before bs5.2.461.17 · source: NVD
RW
Ruggedcom Win7025 Firmware · Siemens
before bs5.2.461.17 · source: NVD
RW
Ruggedcom Win7200 Firmware · Siemens
before bs5.2.461.17 · source: NVD
VX
Vxworks · Windriver
6.6; 6.7; 6.8; 6.9.3; 6.9.4; 7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12264
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
Third Party Advisory
https://support.f5.com/csp/article/K41190253
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03960en_us
Vendor Advisory
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12264
Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
More from Garrettcom Magnum Dx940e Firmware
9.8
CVE-2019-12262
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component
9.8
CVE-2019-12261
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4)
9.8
CVE-2019-12260
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4)
9.8
CVE-2019-12255
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4)
9.8
CVE-2019-12256
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component