{"schemaVersion":3,"id":"CVE-2019-12255","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.","dates":{"published":"2019-08-09T19:18:03.000Z","modified":"2024-08-04T23:17:39.534Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.75081,"percentile":0.99507,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-0.16899999999999693,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.7525},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.75081,"percentile":0.99507}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.7525,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.75081,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.75081,"percentile":0.99507}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_A0CFC293551C78B6","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"47233","name":"VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/47233","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"dos","platforms":["vxworks"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"dos","platform":"vxworks","file":"exploits/vxworks/dos/47233.py","codes":["CVE-2019-12255"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","description":"The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/120.html"}],"affected":[{"vendor":"belden","product":"garrettcom_magnum_dx940e_firmware","name":"garrettcom magnum dx940e firmware","label":"garrettcom_magnum_dx940e_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.1_y7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.1_y7","eol":null,"hubHref":"/vendor/belden/garrettcom_magnum_dx940e"},{"vendor":"belden","product":"hirschmann_hios","name":"hirschmann hios","label":"hirschmann_hios","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 07.0.07","noFixRecorded":false,"fixedIn":null},{"text":"≤ 07.5.01","noFixRecorded":false,"fixedIn":null},{"text":"≤ 07.2.04","noFixRecorded":false,"fixedIn":null},{"text":"≤ 05.3.06","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 07.0.07 | ≤ 07.5.01 | ≤ 07.2.04 | ≤ 05.3.06","eol":null,"hubHref":"/vendor/belden/hirschmann_hios"},{"vendor":"netapp","product":"e-series_santricity_os_controller","name":"e-series santricity os controller","label":"e-series_santricity_os_controller","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.00, ≤ 8.40.50.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.00, ≤ 8.40.50.00","eol":null,"hubHref":"/vendor/netapp/e-series_santricity_os_controller"},{"vendor":"siemens","product":"power_meter_9410_firmware","name":"power meter 9410 firmware","label":"power_meter_9410_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.2.1","eol":null,"hubHref":"/vendor/siemens/power_meter_9410"},{"vendor":"siemens","product":"ruggedcom_win7000_firmware","name":"ruggedcom win7000 firmware","label":"ruggedcom_win7000_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< bs5.2.461.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< bs5.2.461.17","eol":null,"hubHref":"/vendor/siemens/ruggedcom_win7000"},{"vendor":"siemens","product":"ruggedcom_win7018_firmware","name":"ruggedcom win7018 firmware","label":"ruggedcom_win7018_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< bs5.2.461.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< bs5.2.461.17","eol":null,"hubHref":"/vendor/siemens/ruggedcom_win7018"},{"vendor":"siemens","product":"ruggedcom_win7025_firmware","name":"ruggedcom win7025 firmware","label":"ruggedcom_win7025_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< bs5.2.461.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< bs5.2.461.17","eol":null,"hubHref":"/vendor/siemens/ruggedcom_win7025"},{"vendor":"siemens","product":"ruggedcom_win7200_firmware","name":"ruggedcom win7200 firmware","label":"ruggedcom_win7200_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< bs5.2.461.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< bs5.2.461.17","eol":null,"hubHref":"/vendor/siemens/ruggedcom_win7200"},{"vendor":"siemens","product":"siprotec_5_firmware","name":"siprotec 5 firmware","label":"siprotec_5_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 7.91","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.91","eol":null,"hubHref":"/vendor/siemens/siprotec_5"},{"vendor":"sonicwall","product":"sonicos","name":"sonicos","label":"sonicos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 5.9.0.0, ≤ 5.9.0.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.9.1.0., ≤ 5.9.1.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0.0, ≤ 6.2.3.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.4.0, ≤ 6.2.4.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.5.0, ≤ 6.2.5.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.6.0, ≤ 6.2.6.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.7.0, ≤ 6.2.7.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.9.0, ≤ 6.2.9.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.0.0, ≤ 6.5.0.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.1.0, ≤ 6.5.1.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.2.0, ≤ 6.5.2.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.3.0, ≤ 6.5.3.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.5.4.0., ≤ 6.5.4.3","noFixRecorded":false,"fixedIn":null},{"text":"6.2.7.0","noFixRecorded":false,"fixedIn":null},{"text":"6.2.7.1","noFixRecorded":false,"fixedIn":null},{"text":"6.2.7.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.9.0.0, ≤ 5.9.0.7 | ≥ 5.9.1.0., ≤ 5.9.1.12 | ≥ 6.2.0.0, ≤ 6.2.3.1 | ≥ 6.2.4.0, ≤ 6.2.4.3 | ≥ 6.2.5.0, ≤ 6.2.5.3 | ≥ 6.2.6.0, ≤ 6.2.6.1 | ≥ 6.2.7.0, ≤ 6.2.7.4 | ≥ 6.2.9.0, ≤ 6.2.9.2 | ≥ 6.5.0.0, ≤ 6.5.0.3 | ≥ 6.5.1.0, ≤ 6.5.1.4 | ≥ 6.5.2.0, ≤ 6.5.2.3 | ≥ 6.5.3.0, ≤ 6.5.3.3 | ≥ 6.5.4.0., ≤ 6.5.4.3 | 6.2.7.0 | 6.2.7.1 | 6.2.7.7","eol":null,"hubHref":"/vendor/sonicwall/sonicos"},{"vendor":"windriver","product":"vxworks","name":"vxworks","label":"vxworks","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 6.5, < 6.9.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.5, < 6.9.4","eol":null,"hubHref":"/vendor/windriver/vxworks"}],"affectedCount":11,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support2.windriver.com/index.php?page=security-notices","label":"support2.windriver.com/index.php?page=security-notices","hostname":"support2.windriver.com","tags":["X Refsource MISC","Issue Tracking","Vendor Advisory"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009","label":"psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009","hostname":"psirt.global.sonicwall.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf","hostname":"cert-portal.siemens.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190802-0001/","label":"security.netapp.com/advisory/ntap-20190802-0001/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/","label":"www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/","hostname":"www.windriver.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255","label":"support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12255","hostname":"support2.windriver.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html","label":"packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://support.f5.com/csp/article/K41190253","label":"support.f5.com/csp/article/K41190253","hostname":"support.f5.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf","hostname":"cert-portal.siemens.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS","label":"support.f5.com/csp/article/K41190253?utm_source=f5support&amp%3Butm_medium=RSS","hostname":"support.f5.com","tags":["X Refsource CONFIRM"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf","hostname":"cert-portal.siemens.com","tags":["X Refsource CONFIRM","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2019-08-09T19:18:03.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T23:17:39.534Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:20:26.461Z","stale":false,"partial":false}}