CVE-2019-12257

Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc...

CVE-2019-12257

CVE-2019-12257 affects Wind River VxWorks 6.6–6.9 via a heap-based buffer overflow in the IPnet DHCP client (ipdhcpc) during DHCP Offer/ACK parsing. Several connected advisories (Tenable OT plugins, ICS/CISA entries, and vendor briefs) confirm the vulnerability in the IPnet DHCP path and indicate...

CVE-2019-12260: Buffer Copy without Checking Size of Input

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component issue 2 of 4. This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option...

CVE-2019-12255: Buffer Copy without Checking Size of Input

Wind River VxWorks has a Buffer Overflow in the TCP component issue 1 of 4. This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow...

URGENT/11 Scanner, Based on Detection Tool by Armis

This module detects VxWorks and the IPnet IP stack, along with devices vulnerable to CVE-2019-12258. Module Options msf use auxiliary/scanner/vxworks/urgent11/check msf undefinedcheck show actions ...actions... msf undefinedcheck set ACTION msf undefinedcheck show options ...show and set options...

VxWorks is facing severe RCE attack risk-vulnerability warning-the black bar safety net

Armis research team in the VxWorks discovered 11 zero-day vulnerabilities, VxWorks may be the most widely used of theoperating system. VxWorks is more than 20 million devices in use, including critical industrial, medical and business equipment. Called the“URGENT/11,”the vulnerability exists in t...

'URGENT/11' Critical Infrastructure Bugs Threaten EternalBlue-Style Attacks

UPDATE A cadre of 11 vulnerabilities, six of them critical remote code-execution RCE bugs, have been uncovered that affect millions of critical infrastructure systems, such as SCADA gear at utilities, elevator and industrial controllers, patient monitors and MRI machines, programmable logic...

Wind River VxWorks Multiple Vulnerabilities (URGENT/11)

According to its self-reported version, the remote device is potentially affected by multiple Wind River VxWorks remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to...

CVE-2015-3963

CVE-2015-3963 describes a TCP initial sequence number (ISN) predictability vulnerability in Wind River VxWorks (various versions, including 5.x–7.x as deployed by Schneider Electric SAGE RTUs). The root cause is generation of predictable TCP ISNs, enabling remote attackers to spoof or disrupt TCP...