CVE-2019-12258: belden garrettcom_magnum_dx940e_firmware Session Fixation
CVSS: 7.5v3.1HighModified
Published 09-08-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12258 is a high (CVSS 7.5) Session Fixation vulnerability in belden garrettcom_magnum_dx940e_firmware. EPSS estimates a 22.77% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
22.77%
0%100%
High · -0.58 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1metasploit
Timeline
- 09-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
22.77%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
-0.58 pp
From 23.35% on 19-09-2026
19-09-202619-10-2026
EPSS score22.77%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundURGENT/11 Scanner, Based on Detection Tool by Armis
auxiliary/scanner/vxworks/urgent11_check
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Siemens6 products
- power_meter_9410_firmware< 2.2.1
- ruggedcom_win7000_firmware< bs5.2.461.17
- ruggedcom_win7018_firmware< bs5.2.461.17
- ruggedcom_win7025_firmware< bs5.2.461.17
- ruggedcom_win7200_firmware< bs5.2.461.17
Belden2 products
- garrettcom_magnum_dx940e_firmware≤ 1.0.1_y7
- hirschmann_hios≤ 07.0.07 | ≤ 07.5.01 | ≤ 07.2.04 | ≤ 05.3.06
Netapp1 product
- e-series_santricity_os_controller≥ 8.00, ≤ 8.40.50.00
Sonicwall1 product
- sonicos≥ 5.9.0.0, ≤ 5.9.0.7 | ≥ 5.9.1.0., ≤ 5.9.1.12 | ≥ 6.2.0.0, ≤ 6.2.3.1 | ≥ 6.2.4.0, ≤ 6.2.4.3 | ≥ 6.2.5.0, ≤ 6.2.5.3 | ≥ 6.2.6.0, ≤ 6.2.6.1 | ≥ 6.2.7.0, ≤ 6.2.7.4 | ≥ 6.2.9.0, ≤ 6.2.9.2 | ≥ 6.5.0.0, ≤ 6.5.0.3 | ≥ 6.5.1.0, ≤ 6.5.1.4 | ≥ 6.5.2.0, ≤ 6.5.2.3 | ≥ 6.5.3.0, ≤ 6.5.3.3 | ≥ 6.5.4.0., ≤ 6.5.4.3 | 6.2.7.0 | 6.2.7.1 | 6.2.7.7
Windriver1 product
- vxworks≥ 6.5, < 6.9.4.12 | 7.0
5 vendors · 11 products
References
9 links- www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/X Refsource CONFIRMVendor Advisory