{"schemaVersion":3,"id":"CVE-2020-10060","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","dates":{"published":"2020-05-11T22:26:16.934Z","modified":"2024-09-16T23:31:11.924Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01559,"percentile":0.74876,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01559},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01559,"percentile":0.74876}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01559,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01559,"percentile":0.74876}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"},{"id":"CWE-824","name":"Access of Uninitialized Pointer","description":"The product accesses or uses a pointer that has not been initialized.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/824.html"}],"affected":[{"vendor":"zephyrproject-rtos","product":"zephyr","name":"Zephyr","label":"zephyr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, < unspecified","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < unspecified","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < unspecified | ≥ 2.2.0, < unspecified","eol":null,"hubHref":"/vendor/zephyrproject-rtos/zephyr"},{"vendor":"zephyrproject","product":"zephyr","name":"zephyr","label":"zephyr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.1.0, < 2.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.1.0, < 2.4.0","eol":null,"hubHref":"/vendor/zephyrproject/zephyr"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-37","label":"zephyrprojectsec.atlassian.net/browse/ZEPSEC-37","hostname":"zephyrprojectsec.atlassian.net","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10060","label":"docs.zephyrproject.org/latest/security/vulnerabilities.html","hostname":"docs.zephyrproject.org","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27865","label":"github.com/zephyrproject-rtos/zephyr/pull/27865","hostname":"github.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27889","label":"github.com/zephyrproject-rtos/zephyr/pull/27889","hostname":"github.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27891","label":"github.com/zephyrproject-rtos/zephyr/pull/27891","hostname":"github.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27893","label":"github.com/zephyrproject-rtos/zephyr/pull/27893","hostname":"github.com","tags":["X Refsource CONFIRM","Patch","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-05-11T22:26:16.934Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T23:31:11.924Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T09:52:36.779Z","stale":false,"partial":false}}