CVE-2019-12260:

Buffer Overflow in Wind River VxWorks TCP component (IPNET) due to a malformed TCP AO option, affecting VxWorks 6.9 and vx7 (CVE-2019-12260).

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Aug 9, 2019
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:25.6
EPSS Percentile:96%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Buffer Overflow in Wind River VxWorks TCP component (IPNET) due to a malformed TCP AO option, affecting VxWorks 6.9 and vx7 (CVE-2019-12260).

Overview

This vulnerability concerns the IPNET TCP stack in Wind River VxWorks 6.9 and vx7, where a malformed TCP AO option can lead to Urgent Pointer state confusion and a subsequent buffer overflow in the TCP component. It is identified as CVE-2019-12260 and is one of multiple TCP/IP stack issues reported for the platform.

Remediation

Apply the vendor-provided patch or upgrade to a fixed release for Wind River VxWorks 6.9/vx7 as specified in Wind River security advisories. Check the Wind River support portal for the exact patched versions addressing CVE-2019-12260.
If a patch is not immediately available, implement vendor-recommended mitigations: restrict exposure of the affected TCP/IP stack through network segmentation and firewall rules, and apply any configuration changes or workarounds documented by Wind River in their security notices.
Validate remediation in a controlled environment before deploying to production, and maintain evidence of patch levels and tested configurations.
Monitor for further advisories and confirm that all affected devices are tracked in your vulnerability management program.