CVE-2019-12262:Wind River VxWorks RARP client component has an incorrect access control flaw in IPNET, handling unsolicited Reverse ARP replies (CVE-2019-12262).

splash
Back

Description Preview

Wind River VxWorks versions 6.6, 6.7, 6.8, 6.9 and 7 contain an Incorrect Access Control in the RARP client component. This IPNET security vulnerability relates to the handling of unsolicited Reverse ARP replies, described as a logical flaw. The issue could allow an attacker on the local network to influence ARP resolution on affected devices, potentially enabling traffic misdirection or disruption.

Overview

This CVE covers an IPNET security vulnerability in Wind River VxWorks where the RARP client does not enforce proper access control for unsolicited Reverse ARP replies. Affected releases (VxWorks 6.6 through 7) may be exposed to ARP-related manipulation by a nearby attacker, depending on network exposure and device configuration. The risk centers on unauthorized ARP processing that could impact network traffic integrity on vulnerable systems.

Remediation

  1. Apply vendor-provided patch or upgrade Wind River VxWorks to a version that fixes CVE-2019-12262. Contact Wind River support to obtain the appropriate security update and install it in affected systems.
  2. If immediate patching is not possible, implement mitigations to limit exposure:
    • Disable or restrict RARP service if not required in your network design.
    • Segment the affected devices on trusted network segments to reduce ARP traffic exposure.
    • Implement network access controls to limit which devices can participate in ARP and RARP communications.
  3. Enhance monitoring and detection:
    • Enable monitoring for unsolicited ARP replies and unusual ARP traffic patterns on devices running VxWorks.
    • Deploy intrusion detection or anomaly detection capable of flagging ARP-related anomalies.
  4. Asset and patch management:
    • Maintain an up-to-date inventory of VxWorks-based devices, with remediation status tracked.
    • Plan regular vulnerability scanning and timely patch management to prevent recurrence.
  5. Validate fixes in a test environment before production deployment and verify that normal ARP operations are unaffected after remediation.

References

  • https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12262
  • https://support.f5.com/csp/article/K41190253
  • https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
  • https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Medium
    Manufacturing
  2. Health Care & Social Assistance: Medium
    Health Care & Social Assistance
  3. Public Administration: Medium
    Public Administration
  4. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  5. Retail Trade: Low
    Retail Trade
  6. Utilities: Low
    Utilities
  7. Transportation & Warehousing: Low
    Transportation & Warehousing
  8. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  9. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  10. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  11. Educational Services: Low
    Educational Services
  12. Information: Low
    Information
  13. Mining: Low
    Mining
  14. Accommodation & Food Services: Low
    Accommodation & Food Services
  15. Finance and Insurance: Low
    Finance and Insurance
  16. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  17. Wholesale Trade: Low
    Wholesale Trade
  18. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  19. Construction: Low
    Construction
  20. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background