CVE-2019-12259
HIGHCVSS 7.5/10EPSS 15.88%
Last modified
CVE-2019-12259 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.. EPSS estimates a 15.88% chance of exploitation in the next 30 days.
Description
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Windriver | Vxworks | >= 6.5, < 6.9.4.12 |
| Windriver | Vxworks | 7.0 |
| Sonicwall | Sonicos | >= 5.9.0.0, <= 5.9.0.7 |
| Sonicwall | Sonicos | >= 5.9.1.0., <= 5.9.1.12 |
| Sonicwall | Sonicos | >= 6.2.0.0, <= 6.2.3.1 |
| Sonicwall | Sonicos | >= 6.2.4.0, <= 6.2.4.3 |
| Sonicwall | Sonicos | >= 6.2.5.0, <= 6.2.5.3 |
| Sonicwall | Sonicos | >= 6.2.6.0, <= 6.2.6.1 |
| Sonicwall | Sonicos | >= 6.2.7.0, <= 6.2.7.4 |
| Sonicwall | Sonicos | >= 6.2.9.0, <= 6.2.9.2 |
| Sonicwall | Sonicos | >= 6.5.0.0, <= 6.5.0.3 |
| Sonicwall | Sonicos | >= 6.5.1.0, <= 6.5.1.4 |
| Sonicwall | Sonicos | >= 6.5.2.0, <= 6.5.2.3 |
| Sonicwall | Sonicos | >= 6.5.3.0, <= 6.5.3.3 |
| Sonicwall | Sonicos | >= 6.5.4.0., <= 6.5.4.3 |
| Sonicwall | Sonicos | 6.2.7.0 |
| Sonicwall | Sonicos | 6.2.7.1 |
| Sonicwall | Sonicos | 6.2.7.7 |
| Siemens | Siprotec 5 Firmware | < 7.59 |
| Siemens | Siprotec 5 Firmware | < 7.91 |
| Siemens | Ruggedcom Win7000 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7200 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7025 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7018 Firmware | < bs5.2.461.17 |
| Siemens | 9410 Power Meter Firmware | < 2.2.1 |
| Siemens | 9810 Power Meter Firmware | < 2.2.1 |
| Belden | Hirschmann Hios | <= 07.0.07 |
| Belden | Hirschmann Hios | <= 07.5.01 |
| Belden | Hirschmann Hios | <= 07.2.04 |
| Belden | Hirschmann Hios | <= 05.3.06 |
| Belden | Garrettcom Magnum Dx940e Firmware | <= 1.0.1_y7 |
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdfThird Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190802-0001/Third Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
- https://support2.windriver.com/index.php?page=security-noticesIssue Tracking, Vendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdfThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdfThird Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190802-0001/Third Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
- https://support2.windriver.com/index.php?page=security-noticesIssue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-12259?
Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
How severe is CVE-2019-12259?
CVE-2019-12259 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 15.88% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12259?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2019-12259?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST