WaratekVRT Sign in

CVE-2019-12258 VxWorks

Affected softwareVxWorks
Severity7.5 High CVSS 3.1 2 scores
WeaknessCWE-384
Published9 Aug 2019
Updated17 Jun 2026

Description

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 23% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

12 products, 32 version entries
SourceVendorProductSchemeAffected versions
nvd belden garrettcom magnum dx940e firmware generic ≤ 1.0.1.7
nvd belden hirschmann hios generic ≤ 5.3.6 · ≤ 7.0.7 · ≤ 7.2.4 · ≤ 7.5.1
nvd netapp e-series santricity os controller generic ≥ 8.0 and ≤ 8.40.50.0
nvd siemens power meter 9410 firmware generic ＜ 2.2.1
nvd siemens power meter 9810 firmware generic any version
nvd siemens ruggedcom win7000 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7018 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7025 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7200 firmware generic ＜ 5.2.461.17
nvd siemens siprotec 5 firmware generic ＜ 7.59 · ＜ 7.91
nvd sonicwall sonicos generic ≥ 5.9.0.0 and ≤ 5.9.0.7 · ≥ 5.9.1.0 and ≤ 5.9.1.12 · ≥ 6.2.0.0 and ≤ 6.2.3.1 · ≥ 6.2.4.0 and ≤ 6.2.4.3 · ≥ 6.2.5.0 and ≤ 6.2.5.3 · ≥ 6.2.6.0 and ≤ 6.2.6.1 · 6.2.7.0 · ≥ 6.2.7.0 and ≤ 6.2.7.4 · 6.2.7.1 · 6.2.7.7 · ≥ 6.2.9.0 and ≤ 6.2.9.2 · ≥ 6.5.0.0 and ≤ 6.5.0.3 · ≥ 6.5.1.0 and ≤ 6.5.1.4 · ≥ 6.5.2.0 and ≤ 6.5.2.3 · ≥ 6.5.3.0 and ≤ 6.5.3.3 · ≥ 6.5.4.0 and ≤ 6.5.4.3
nvd windriver vxworks generic ≥ 6.5 and ＜ 6.9.4.12 · 7.0

References

URLTags
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190802-0001/ Third Party Advisory
https://support.f5.com/csp/article/K41190253 Third Party Advisory
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12258 Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices Issue Tracking, Vendor Advisory
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/ Vendor Advisory

Timeline
Published2019-08-09By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.