CVE-2020-25928

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall(), getoffset(), dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the "response data length" field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context.

• CWE-125
• CWE-787

• https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/Mitigation, Third Party Advisory
• https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/Mitigation, Third Party Advisory
• https://www.kb.cert.org/vuls/id/608209Third Party Advisory, US Government Resource

Published

Aug 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25915Cross Site Scripting (XSS) vulnerability in UserController.p…5.4
• CVE-2020-25917Stratodesk NoTouch Center before 4.4.68 is affected by: Inco…8.8
• CVE-2020-2592Vulnerability in the Oracle AutoVue product of Oracle Supply…5.3
• CVE-2020-25925Cross Site Scripting (XSS) in Webmail Calender in IceWarp We…6.1
• CVE-2020-25926The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affe…7.5
• CVE-2020-25927The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is aff…7.5
• CVE-2020-2593Vulnerability in the Java SE, Java SE Embedded product of Or…4.8
• CVE-2020-2594Vulnerability in the Primavera P6 Enterprise Project Portfol…6.5
• CVE-2020-2595Vulnerability in the Oracle GraalVM Enterprise Edition produ…5.8
• CVE-2020-25950Advanced Webhost Billing System 3.7.0 is affected by Cross S…4.3
• CVE-2020-25952SQL injection vulnerability in PHPGurukul User Registration …9.8
• CVE-2020-25955SourceCodester Student Management System Project in PHP vers…5.4