CVE-2019-12259:

Wind River VxWorks IPNET IGMPv3 client contains an array index error that can cause a denial of service via NULL dereference during IGMP parsing in VxWorks 6.6–6.9 and vx7.

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.5High

Published Date:Aug 9, 2019
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:24.5
EPSS Percentile:96%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:NONE
Integrity Impact:NONE
Availability Impact:HIGH

Description Preview

Wind River VxWorks IPNET IGMPv3 client contains an array index error that can cause a denial of service via NULL dereference during IGMP parsing in VxWorks 6.6–6.9 and vx7.

Overview

This CVE describes an IPNET security vulnerability in the Wind River VxWorks IGMPv3 client where an array index error can cause a NULL dereference during IGMP parsing, potentially leading to a Denial of Service on affected systems. The vulnerable product family includes Wind River VxWorks versions 6.6 through 6.9 and the vx7 line. The vulnerability is identified as CVE-2019-12259, and multiple vendor advisories (including Wind River, Siemens, NetApp, SonicWall, and F5) reference this issue and its remediation context.

Remediation

Update to the fixed version or apply the patch provided by Wind River for IPNET/IGMPv3 on VxWorks (check Wind River advisories and the CVE page for the exact recommended builds).
If upgrading is not feasible, apply mitigations to limit exposure:
Restrict or disable IGMP processing on affected devices if IGMP is not required in your network design.
Implement network filtering to block or strictly control IGMP traffic from untrusted networks (e.g., at edge or perimeter devices).
Enforce strict ACLs/firewalls to drop malformed or unexpected IGMP packets.
Enable monitoring and alerting for abnormal IGMP activity to detect potential exploitation attempts.
Validate any changes in a testing environment before deployment and review vendor advisories for additional mitigations or prerequisites.
Coordinate with the affected device vendors (Wind River and any dependent vendors) to ensure alignment with official remediation guidance.