^{CVE-2019-12259:}Wind River VxWorks IPNET IGMPv3 client contains an array index error that can cause a denial of service via NULL dereference during IGMP parsing in VxWorks 6.6–6.9 and vx7.

Overview

This CVE describes an IPNET security vulnerability in the Wind River VxWorks IGMPv3 client where an array index error can cause a NULL dereference during IGMP parsing, potentially leading to a Denial of Service on affected systems. The vulnerable product family includes Wind River VxWorks versions 6.6 through 6.9 and the vx7 line. The vulnerability is identified as CVE-2019-12259, and multiple vendor advisories (including Wind River, Siemens, NetApp, SonicWall, and F5) reference this issue and its remediation context.

Remediation

• Update to the fixed version or apply the patch provided by Wind River for IPNET/IGMPv3 on VxWorks (check Wind River advisories and the CVE page for the exact recommended builds).
• If upgrading is not feasible, apply mitigations to limit exposure:
  • Restrict or disable IGMP processing on affected devices if IGMP is not required in your network design.
  • Implement network filtering to block or strictly control IGMP traffic from untrusted networks (e.g., at edge or perimeter devices).
  • Enforce strict ACLs/firewalls to drop malformed or unexpected IGMP packets.
  • Enable monitoring and alerting for abnormal IGMP activity to detect potential exploitation attempts.
• Validate any changes in a testing environment before deployment and review vendor advisories for additional mitigations or prerequisites.
• Coordinate with the affected device vendors (Wind River and any dependent vendors) to ensure alignment with official remediation guidance.

References

• https://support2.windriver.com/index.php?page=security-notices
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
• https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
• https://security.netapp.com/advisory/ntap-20190802-0001/
• https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12259
• https://support.f5.com/csp/article/K41190253
• https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf