CVE-2019-12259
HIGHCVSS 7.5/10EPSS 15.88%
Last modified
CVE-2019-12259 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.. EPSS estimates a 15.88% chance of exploitation in the next 30 days.
Description
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Windriver | Vxworks | >= 6.5, < 6.9.4.12 |
| Windriver | Vxworks | 7.0 |
| Sonicwall | Sonicos | >= 5.9.0.0, <= 5.9.0.7 |
| Sonicwall | Sonicos | >= 5.9.1.0., <= 5.9.1.12 |
| Sonicwall | Sonicos | >= 6.2.0.0, <= 6.2.3.1 |
| Sonicwall | Sonicos | >= 6.2.4.0, <= 6.2.4.3 |
| Sonicwall | Sonicos | >= 6.2.5.0, <= 6.2.5.3 |
| Sonicwall | Sonicos | >= 6.2.6.0, <= 6.2.6.1 |
| Sonicwall | Sonicos | >= 6.2.7.0, <= 6.2.7.4 |
| Sonicwall | Sonicos | >= 6.2.9.0, <= 6.2.9.2 |
| Sonicwall | Sonicos | >= 6.5.0.0, <= 6.5.0.3 |
| Sonicwall | Sonicos | >= 6.5.1.0, <= 6.5.1.4 |
| Sonicwall | Sonicos | >= 6.5.2.0, <= 6.5.2.3 |
| Sonicwall | Sonicos | >= 6.5.3.0, <= 6.5.3.3 |
| Sonicwall | Sonicos | >= 6.5.4.0., <= 6.5.4.3 |
| Sonicwall | Sonicos | 6.2.7.0 |
| Sonicwall | Sonicos | 6.2.7.1 |
| Sonicwall | Sonicos | 6.2.7.7 |
| Siemens | Siprotec 5 Firmware | < 7.59 |
| Siemens | Siprotec 5 Firmware | < 7.91 |
| Siemens | Ruggedcom Win7000 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7200 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7025 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7018 Firmware | < bs5.2.461.17 |
| Siemens | 9410 Power Meter Firmware | < 2.2.1 |
| Siemens | 9810 Power Meter Firmware | < 2.2.1 |
| Belden | Hirschmann Hios | <= 07.0.07 |
| Belden | Hirschmann Hios | <= 07.5.01 |
| Belden | Hirschmann Hios | <= 07.2.04 |
| Belden | Hirschmann Hios | <= 05.3.06 |
| Belden | Garrettcom Magnum Dx940e Firmware | <= 1.0.1_y7 |
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdfThird Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190802-0001/Third Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
- https://support2.windriver.com/index.php?page=security-noticesIssue Tracking, Vendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdfThird Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190802-0001/Third Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
- https://support2.windriver.com/index.php?page=security-noticesIssue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-12259?
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
How severe is CVE-2019-12259?
CVE-2019-12259 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 15.88% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12259?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-12253my little forum before 2.4.20 allows CSRF to delete posts, a…
- CVE-2019-12254In multiple Tecson Tankspion and GOKs SmartBox 4 products th…9.8
- CVE-2019-12255Wind River VxWorks has a Buffer Overflow in the TCP componen…9.8
- CVE-2019-12256Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the …9.8
- CVE-2019-12257Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in …8.8
- CVE-2019-12258Wind River VxWorks 6.6 through vx7 has Session Fixation in t…7.5
- CVE-2019-1226A remote code execution vulnerability exists in Remote Deskt…9.8
- CVE-2019-12260Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the …9.8
- CVE-2019-12261Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overf…9.8
- CVE-2019-12262Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Ac…9.8
- CVE-2019-12263Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in th…8.1
- CVE-2019-12264Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has …7.1
Are you affected by CVE-2019-12259?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST