CVE-2019-12264
HIGHCVSS 7.1/10EPSS 8.31%
Last modified
CVE-2019-12264 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.. EPSS estimates a 8.31% chance of exploitation in the next 30 days.
Description
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Windriver | Vxworks | 6.6 |
| Windriver | Vxworks | 6.7 |
| Windriver | Vxworks | 6.8 |
| Windriver | Vxworks | 6.9.3 |
| Windriver | Vxworks | 6.9.4 |
| Windriver | Vxworks | 7.0 |
| Belden | Hirschmann Hios | <= 07.0.07 |
| Belden | Hirschmann Hios | <= 07.5.01 |
| Belden | Hirschmann Hios | <= 07.2.04 |
| Belden | Hirschmann Hios | <= 05.3.06 |
| Belden | Garrettcom Magnum Dx940e Firmware | <= 1.0.1_y7 |
| Siemens | Ruggedcom Win7000 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7018 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7025 Firmware | < bs5.2.461.17 |
| Siemens | Ruggedcom Win7200 Firmware | < bs5.2.461.17 |
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdfThird Party Advisory
- https://support.f5.com/csp/article/K41190253Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-12264?
Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.
How severe is CVE-2019-12264?
CVE-2019-12264 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 8.31% probability of exploitation in the next 30 days.
How do I fix CVE-2019-12264?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-12259Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array i…7.5
- CVE-2019-1226A remote code execution vulnerability exists in Remote Deskt…9.8
- CVE-2019-12260Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the …9.8
- CVE-2019-12261Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overf…9.8
- CVE-2019-12262Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Ac…9.8
- CVE-2019-12263Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in th…8.1
- CVE-2019-12265Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a…5.3
- CVE-2019-12266Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2…9.8
- CVE-2019-12269Enigmail before 2.0.11 allows PGP signature spoofing: for an…
- CVE-2019-1227An information disclosure vulnerability exists when the Wind…5.5
- CVE-2019-12270OpenText Brava! Enterprise and Brava! Server 7.5 through 16.…
- CVE-2019-12271Sandline Centraleyezer (On Premises) allows unrestricted Fil…9.8
Are you affected by CVE-2019-12264?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST