Vulnerability Details : CVE-2018-16528
Amazon Web Services (AWS) FreeRTOS through 1.3.1 allows remote attackers to execute arbitrary code because of mbedTLS context object corruption in prvSetupConnection and GGD_SecureConnect_Connect in AWS TLS connectivity modules.
Vulnerability category: Input validationExecute code
Products affected by CVE-2018-16528
- cpe:2.3:a:amazon:amazon_web_services_freertos:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-16528
5.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-16528
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
8.1
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2018-16528
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-16528
-
https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md
amazon-freertos/CHANGELOG.md at v1.3.2 · aws/amazon-freertos · GitHubThird Party Advisory
-
https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/
FreeRTOS TCP/IP Stack Vulnerabilities Put A Wide Range of Devices at Risk of Compromise: From Smart Homes to Critical Infrastructure Systems | Zimperium Mobile Security BlogThird Party Advisory
-
https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/
FreeRTOS TCP/IP Stack Vulnerabilities - The Details | Zimperium Mobile Security BlogThird Party Advisory
Jump to