CVE-2019-12255: belden garrettcom_magnum_dx940e_firmware Classic Buffer Overflow
Vulnerability summary
CVE-2019-12255 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in belden garrettcom_magnum_dx940e_firmware. EPSS estimates a 75.08% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 09-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
75.08%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
-0.17 pp
From 75.25% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Siemens6 products
- power_meter_9410_firmware< 2.2.1
- ruggedcom_win7000_firmware< bs5.2.461.17
- ruggedcom_win7018_firmware< bs5.2.461.17
- ruggedcom_win7025_firmware< bs5.2.461.17
- ruggedcom_win7200_firmware< bs5.2.461.17
Belden2 products
- garrettcom_magnum_dx940e_firmware≤ 1.0.1_y7
- hirschmann_hios≤ 07.0.07 | ≤ 07.5.01 | ≤ 07.2.04 | ≤ 05.3.06
Netapp1 product
- e-series_santricity_os_controller≥ 8.00, ≤ 8.40.50.00
Sonicwall1 product
- sonicos≥ 5.9.0.0, ≤ 5.9.0.7 | ≥ 5.9.1.0., ≤ 5.9.1.12 | ≥ 6.2.0.0, ≤ 6.2.3.1 | ≥ 6.2.4.0, ≤ 6.2.4.3 | ≥ 6.2.5.0, ≤ 6.2.5.3 | ≥ 6.2.6.0, ≤ 6.2.6.1 | ≥ 6.2.7.0, ≤ 6.2.7.4 | ≥ 6.2.9.0, ≤ 6.2.9.2 | ≥ 6.5.0.0, ≤ 6.5.0.3 | ≥ 6.5.1.0, ≤ 6.5.1.4 | ≥ 6.5.2.0, ≤ 6.5.2.3 | ≥ 6.5.3.0, ≤ 6.5.3.3 | ≥ 6.5.4.0., ≤ 6.5.4.3 | 6.2.7.0 | 6.2.7.1 | 6.2.7.7
Windriver1 product
- vxworks≥ 6.5, < 6.9.4
5 vendors · 11 products
References
11 links- www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/X Refsource CONFIRMVendor Advisory
- packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry