WaratekVRT Sign in

CVE-2019-12260 VxWorks

Affected softwareVxWorks
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessCWE-120
Published9 Aug 2019
Updated17 Jun 2026

Description

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 23% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Communications / Measurements (VxWorks) (46.6.0-46.8.2)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Communications / Network Stack (Wind River VxWorks) (46.6.0-46.8.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Measurements (VxWorks) 46.6.0-46.8.2
Oracle Communications Network Stack (Wind River VxWorks) 46.6.0-46.8.2

Products and versions

13 products, 33 version entries
SourceVendorProductSchemeAffected versions
nvd belden garrettcom magnum dx940e firmware generic ≤ 1.0.1.7
nvd belden hirschmann hios generic ≤ 5.3.6 · ≤ 7.0.7 · ≤ 7.2.4 · ≤ 7.5.1
nvd netapp e-series santricity os controller generic ≥ 8.0 and ≤ 8.40.50.0
nvd oracle communications eagle generic ≥ 46.6.0 and ≤ 46.8.2
nvd siemens power meter 9410 firmware generic ＜ 2.2.1
nvd siemens power meter 9810 firmware generic any version
nvd siemens ruggedcom win7000 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7018 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7025 firmware generic ＜ 5.2.461.17
nvd siemens ruggedcom win7200 firmware generic ＜ 5.2.461.17
nvd siemens siprotec 5 firmware generic ＜ 7.59 · ＜ 7.91
nvd sonicwall sonicos generic ≥ 5.9.0.0 and ≤ 5.9.0.7 · ≥ 5.9.1.0 and ≤ 5.9.1.12 · ≥ 6.2.0.0 and ≤ 6.2.3.1 · ≥ 6.2.4.0 and ≤ 6.2.4.3 · ≥ 6.2.5.0 and ≤ 6.2.5.3 · ≥ 6.2.6.0 and ≤ 6.2.6.1 · 6.2.7.0 · ≥ 6.2.7.0 and ≤ 6.2.7.4 · 6.2.7.1 · 6.2.7.7 · ≥ 6.2.9.0 and ≤ 6.2.9.2 · ≥ 6.5.0.0 and ≤ 6.5.0.3 · ≥ 6.5.1.0 and ≤ 6.5.1.4 · ≥ 6.5.2.0 and ≤ 6.5.2.3 · ≥ 6.5.3.0 and ≤ 6.5.3.3 · ≥ 6.5.4.0 and ≤ 6.5.4.3
nvd windriver vxworks generic ≥ 6.5 and ＜ 6.9.4.12 · 7.0

References

URLTags
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009 Third Party Advisory
https://security.netapp.com/advisory/ntap-20190802-0001/ Third Party Advisory
https://support.f5.com/csp/article/K41190253 Third Party Advisory
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12260 Vendor Advisory
https://support2.windriver.com/index.php?page=security-notices Issue Tracking, Vendor Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory

Timeline
Published2019-08-09By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.