CVE-2020-17443

An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around, leading to memory corruption and, eventually, Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.

• CWE-190
• CWE-787

• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17438An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…9.8
• CVE-2020-17439An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…8.3
• CVE-2020-1744A flaw was found in keycloak before version 9.0.1. When conf…5.6
• CVE-2020-17440An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…7.5
• CVE-2020-17441An issue was discovered in picoTCP 1.7.0. The code for proce…9.1
• CVE-2020-17442An issue was discovered in picoTCP 1.7.0. The code for parsi…7.5
• CVE-2020-17444An issue was discovered in picoTCP 1.7.0. The routine for pr…7.5
• CVE-2020-17445An issue was discovered in picoTCP 1.7.0. The code for proce…7.5
• CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server t…9.8
• CVE-2020-17447Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17448Telegram Desktop through 2.1.13 allows a spoofed file type t…7.8
• CVE-2020-17449PHP-Fusion 9.03 allows XSS via the error_log file.5.4