CVE-2016-20009

CRITICAL EPSS 77.1%
Published Mar 11, 20215y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Mar 11, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
77.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 15

VendorProductVersionRange
windrivervxworks*≥6.5  –  ≤7.0
siemenssgt-100_firmware*any
siemenssgt-100*any
siemenssgt-200_firmware*any
siemenssgt-200*any
siemenssgt-300_firmware*any
siemenssgt-300*any
siemenssgt-400_firmware*any
siemenssgt-400*any
siemenssgt-a20_firmware*any
siemenssgt-a20*any
siemenssgt-a35_firmware*any
siemenssgt-a35*any
siemenssgt-a65_firmware*any
siemenssgt-a65*any

References 2

  • blog.exodusintel.com https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/
    ExploitThird Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.