CVE-2019-12264 : Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Con

Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.

Published 2019-08-05 18:15:11

Updated 2022-06-16 18:10:53

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-12264

Windriver » Vxworks » Version: 6.6
cpe:2.3:o:windriver:vxworks:6.6:*:*:*:*:*:*:*
Matching versions
Windriver » Vxworks » Version: 6.7
cpe:2.3:o:windriver:vxworks:6.7:*:*:*:*:*:*:*
Matching versions
Windriver » Vxworks » Version: 6.8
cpe:2.3:o:windriver:vxworks:6.8:*:*:*:*:*:*:*
Matching versions
Windriver » Vxworks » Version: 6.9.4
cpe:2.3:o:windriver:vxworks:6.9.4:*:*:*:*:*:*:*
Matching versions
Windriver » Vxworks » Version: 6.9.3
cpe:2.3:o:windriver:vxworks:6.9.3:*:*:*:*:*:*:*
Matching versions
Windriver » Vxworks » Version: 7.0
cpe:2.3:o:windriver:vxworks:7.0:*:*:*:*:*:*:*
Matching versions
Siemens » Ruggedcom Win7000 Firmware
Versions before (<) bs5.2.461.17
cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Win7000 » Version: N/A
Siemens » Ruggedcom Win7200 Firmware
Versions before (<) bs5.2.461.17
cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Win7200 » Version: N/A
Siemens » Ruggedcom Win7025 Firmware
Versions before (<) bs5.2.461.17
cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Win7025 » Version: N/A
Siemens » Ruggedcom Win7018 Firmware
Versions before (<) bs5.2.461.17
cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Ruggedcom Win7018 » Version: N/A
Belden » Hirschmann Hios
Versions up to, including, (<=) 07.5.01
cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*
Matching versions
When used together with: Belden » Hirschmann Msp40 » Version: N/A
When used together with: Belden » Hirschmann Octopus Os3 » Version: N/A
Belden » Hirschmann Hios
Versions up to, including, (<=) 07.0.07
cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*
Matching versions
When used together with: Belden » Hirschmann Ees20 » Version: N/A
When used together with: Belden » Hirschmann Ees25 » Version: N/A
When used together with: Belden » Hirschmann Eesx20 » Version: N/A
When used together with: Belden » Hirschmann Eesx30 » Version: N/A
When used together with: Belden » Hirschmann Grs1020 » Version: N/A
When used together with: Belden » Hirschmann Grs1030 » Version: N/A
When used together with: Belden » Hirschmann Grs1042 » Version: N/A
When used together with: Belden » Hirschmann Grs1120 » Version: N/A
When used together with: Belden » Hirschmann Grs1130 » Version: N/A
When used together with: Belden » Hirschmann Grs1142 » Version: N/A
When used together with: Belden » Hirschmann Msp30 » Version: N/A
When used together with: Belden » Hirschmann Msp32 » Version: N/A
When used together with: Belden » Hirschmann Rail Switch Power Lite » Version: N/A
When used together with: Belden » Hirschmann Rail Switch Power Smart » Version: N/A
When used together with: Belden » Hirschmann Red25 » Version: N/A
When used together with: Belden » Hirschmann Rsp20 » Version: N/A
When used together with: Belden » Hirschmann Rsp25 » Version: N/A
When used together with: Belden » Hirschmann Rsp30 » Version: N/A
When used together with: Belden » Hirschmann Rsp35 » Version: N/A
When used together with: Belden » Hirschmann Rspe30 » Version: N/A
When used together with: Belden » Hirschmann Rspe32 » Version: N/A
When used together with: Belden » Hirschmann Rspe35 » Version: N/A
When used together with: Belden » Hirschmann Rspe37 » Version: N/A
Belden » Hirschmann Hios
Versions up to, including, (<=) 07.2.04
cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*
Matching versions
When used together with: Belden » Hirschmann Dragon Mach4000 » Version: N/A
When used together with: Belden » Hirschmann Dragon Mach4500 » Version: N/A
Belden » Hirschmann Hios
Versions up to, including, (<=) 05.3.06
cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*
Matching versions
When used together with: Belden » Hirschmann Eagle One » Version: N/A
When used together with: Belden » Hirschmann Eagle20 » Version: N/A
When used together with: Belden » Hirschmann Eagle30 » Version: N/A
Belden » Garrettcom Magnum Dx940e Firmware
Versions up to, including, (<=) 1.0.1_y7
cpe:2.3:o:belden:garrettcom_magnum_dx940e_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Belden » Garrettcom Magnum Dx940e » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-12264

EPSS FAQ

0.37%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-12264

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.8	MEDIUM	AV:A/AC:L/Au:N/C:N/I:P/A:P	6.5	4.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
7.1	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	2.8	4.2	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: High

CWE ids for CVE-2019-12264

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12264

https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12264

CVE-2019-12264 - Wind River Support Network
Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/

SECURITY VULNERABILITY RESPONSE INFORMATION - TCP/IP Network Stack (IPnet, Urgent/11)
Vendor Advisory

CVEs referencing this url
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03960en_us

HPESBHF03960 rev.1 - HPE Lights Out 100 (LO100) Remote Management for ProLiant G1 - G6 servers, Remote Denial of Service
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf

Third Party Advisory

CVEs referencing this url
https://support.f5.com/csp/article/K41190253

Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2019-12264

Products affected by CVE-2019-12264

Exploit prediction scoring system (EPSS) score for CVE-2019-12264

CVSS scores for CVE-2019-12264

CWE ids for CVE-2019-12264

References for CVE-2019-12264