Windriver vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-51787 An issue was discovered in Wind River VxWorks 7 22.09 and 23.03.High 7.5 · Feb 15, 2024
• CVE-2023-38346 An issue was discovered in Wind River VxWorks 6.9 and 7.High 8.8 · Sep 22, 2023
• CVE-2020-35198 An issue was discovered in Wind River VxWorks 7.Critical 9.8 · May 12, 2021
• CVE-2021-29999 An issue was discovered in Wind River VxWorks through 6.8.Critical 9.8 · Apr 13, 2021
• CVE-2021-29998 An issue was discovered in Wind River VxWorks before 6.5.Critical 9.8 · Apr 13, 2021
• CVE-2016-20009 A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7.Critical 9.8 · Mar 11, 2021
• CVE-2020-28895 In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc().High 7.3 · Feb 3, 2021
• CVE-2020-11440 httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.High 7.5 · Jul 23, 2020
• CVE-2020-10664 The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference.High 7.5 · Apr 27, 2020
• CVE-2019-12262 Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component.Critical 9.8 · Aug 14, 2019
• CVE-2019-12261 Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4).Critical 9.8 · Aug 9, 2019
• CVE-2019-12260 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).Critical 9.8 · Aug 9, 2019
• CVE-2019-12258 Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.High 7.5 · Aug 9, 2019
• CVE-2019-12255 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).Critical 9.8 · Aug 9, 2019
• CVE-2019-12263 Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4).High 8.1 · Aug 9, 2019
• CVE-2019-12259 Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.High 7.5 · Aug 9, 2019
• CVE-2019-12257 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.High 8.8 · Aug 9, 2019
• CVE-2019-12256 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.Critical 9.8 · Aug 9, 2019
• CVE-2019-12264 Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component.High 7.1 · Aug 5, 2019
• CVE-2019-9865 When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an out-of-bounds memoryHigh 8.1 · May 29, 2019
• CVE-2015-7599 Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabledHigh 8.1 · Feb 7, 2017
• CVE-2013-0714 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) viHigh 10 · Mar 20, 2013
• CVE-2013-0711 IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authenticatiHigh 7.8 · Mar 20, 2013
• CVE-2010-2968 The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obHigh 7.8 · Aug 5, 2010
• CVE-2010-2967 The loginDefaultEncrypt algorithm in loginLib in Wind River VxWorks before 6.9 does not properly support a large set of distinct possible passwords, which makesHigh 7.8 · Aug 5, 2010