Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.
Priority HIGH 79CWE-120Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
Why it matters now
EPSS 0.84297 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 53
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* | 6.5 to before 6.9.4 | Vulnerable | Wind River |
| cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* | 5.9.0.0 – 5.9.0.7; 5.9.1.0. – 5.9.1.12; 6.2.0.0 – 6.2.3.1; 6.2.4.0 – 6.2.4.3; 6.2.5.0 – 6.2.5.3; 6.2.6.0 – 6.2.6.1; 6.2.7.0 – 6.2.7.4; 6.2.9.0 – 6.2.9.2; 6.5.0.0 – 6.5.0.3; 6.5.1.0 – 6.5.1.4; 6.5.2.0 – 6.5.2.3; 6.5.3.0 – 6.5.3.3; 6.5.4.0. – 6.5.4.3 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:* | 6.2.7.0 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:* | 6.2.7.1 | Vulnerable | SonicWall |
| cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:* | 6.2.7.7 | Vulnerable | SonicWall |
| cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp200 | before 7.59 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siprotec_5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 8.00 – 8.40.50.00 | Vulnerable | NetApp |
| cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300 | before 7.91 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:* | before bs5.2.461.17 | Vulnerable | Siemens |
- cpe:2.3:o:windriver:vxworks:*:*:*:*:*:*:*:* Versions 6.5 to before 6.9.4 Vulnerable ·Wind River
- cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* Versions 5.9.0.0 – 5.9.0.7; 5.9.1.0. – 5.9.1.12; 6.2.0.0 – 6.2.3.1; 6.2.4.0 – 6.2.4.3; 6.2.5.0 – 6.2.5.3; 6.2.6.0 – 6.2.6.1; 6.2.7.0 – 6.2.7.4; 6.2.9.0 – 6.2.9.2; 6.5.0.0 – 6.5.0.3; 6.5.1.0 – 6.5.1.4; 6.5.2.0 – 6.5.2.3; 6.5.3.0 – 6.5.3.3; 6.5.4.0. – 6.5.4.3 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:* Versions 6.2.7.0 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:* Versions 6.2.7.1 Vulnerable ·SonicWall
- cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:* Versions 6.2.7.7 Vulnerable ·SonicWall
- cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp200 Versions before 7.59 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siprotec_5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 8.00 – 8.40.50.00 Vulnerable ·NetApp
- cpe:2.3:o:siemens:siprotec_5_firmware:*:*:*:*:*:*:*:cp300 Versions before 7.91 Vulnerable ·Siemens
- cpe:2.3:o:siemens:ruggedcom_win7000_firmware:*:*:*:*:*:*:*:* Versions before bs5.2.461.17 Vulnerable ·Siemens
Show 43 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:ruggedcom_win7000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:* | before bs5.2.461.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ruggedcom_win7018:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:* | before bs5.2.461.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ruggedcom_win7025:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:* | before bs5.2.461.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ruggedcom_win7200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* | up to 07.0.07 | Vulnerable | Belden |
| cpe:2.3:h:belden:hirschmann_ees20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_ees25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_eesx20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_eesx30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1030:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1042:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1130:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_grs1142:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_msp30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_msp32:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_red25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rsp20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rsp25:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rsp30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rsp35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rspe30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rspe32:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rspe35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_rspe37:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* | up to 07.5.01 | Vulnerable | Belden |
| cpe:2.3:h:belden:hirschmann_msp40:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_octopus_os3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* | up to 07.2.04 | Vulnerable | Belden |
| cpe:2.3:h:belden:hirschmann_dragon_mach4000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_dragon_mach4500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* | up to 05.3.06 | Vulnerable | Belden |
| cpe:2.3:h:belden:hirschmann_eagle_one:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
| cpe:2.3:o:belden:garrettcom_magnum_dx940e_firmware:*:*:*:*:*:*:*:* | up to 1.0.1_y7 | Vulnerable | Belden |
| cpe:2.3:h:belden:garrettcom_magnum_dx940e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Belden |
- cpe:2.3:h:siemens:ruggedcom_win7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:ruggedcom_win7018_firmware:*:*:*:*:*:*:*:* Versions before bs5.2.461.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ruggedcom_win7018:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:ruggedcom_win7025_firmware:*:*:*:*:*:*:*:* Versions before bs5.2.461.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ruggedcom_win7025:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:ruggedcom_win7200_firmware:*:*:*:*:*:*:*:* Versions before bs5.2.461.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ruggedcom_win7200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* Versions up to 07.0.07 Vulnerable ·Belden
- cpe:2.3:h:belden:hirschmann_ees20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_ees25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_eesx20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_eesx30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1042:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_grs1142:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_msp30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_msp32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_red25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rsp20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rsp25:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rsp30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rsp35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rspe30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rspe32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rspe35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_rspe37:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* Versions up to 07.5.01 Vulnerable ·Belden
- cpe:2.3:h:belden:hirschmann_msp40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_octopus_os3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* Versions up to 07.2.04 Vulnerable ·Belden
- cpe:2.3:h:belden:hirschmann_dragon_mach4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_dragon_mach4500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* Versions up to 05.3.06 Vulnerable ·Belden
- cpe:2.3:h:belden:hirschmann_eagle_one:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
- cpe:2.3:o:belden:garrettcom_magnum_dx940e_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.1_y7 Vulnerable ·Belden
- cpe:2.3:h:belden:garrettcom_magnum_dx940e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12257
- 2026-10-03 Alias added: GHSA-qhhx-3278-fj99
References
Advisory 8
- https://support2.windriver.com/index.php?page=security-notices
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
- https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
- https://security.netapp.com/advisory/ntap-20190802-0001/
- https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12257
- https://support.f5.com/csp/article/K41190253
- https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
Sources
- CVE-2019-12257 · CVE Program
- CVE-2019-12257 · NVD
- FIRST EPSS
- GHSA-qhhx-3278-fj99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences