CVE-2019-12255

PoC —1

CVSS 3.1

9.8 critical

EPSS

75%p99

Published

Aug 9, 2019 (Aug 9, 2019)

Modified

Jun 17, 2026

Description

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.

Vendors: windriver netapp sonicwall siemens belden
Products: vxworks, e-series santricity os controller, sonicos, siprotec 5 firmware, power meter 9410 firmware, power meter 9810 firmware, ruggedcom win7000 firmware, ruggedcom win7018 firmware, ruggedcom win7025 firmware, ruggedcom win7200 firmware, hirschmann hios, garrettcom magnum dx940e firmware
Weakness: CWE-120
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (75.3%)

In the news7 stories

Know Your Infusion Pump Vulnerabilities and Secure Your Healthcare Organization

Palo Alto Unit 42Jun 5, 23:27 UTC · Jun 5, 2024Vulnerability CVE-2019-12255 CVE-2019-12264 CVE-2016-9355+7 CVEs1

60

200 million enterprise, industrial, and medical devices affected by RCE flaws in VxWorks RTOS

Help Net SecurityNov 14, 13:02 UTC · Nov 14, 2023Vulnerability in the wildCVE-2019-12255 CVE-2019-122621

60

75% Of Medical Infusion Pumps Affected By Known Vulnerabilities

Security AffairsMar 3, 19:48 UTC · Mar 3, 2022Vulnerability CVE-2019-12255 CVE-2019-12264 CVE-2016-9355+7 CVEs

60

Critical zero-days discovered in VxWorks RTOS, billions of devices at risk

Security AffairsJul 30, 07:25 UTC · Jul 30, 2019Exploit / PoC CVE-2019-12256 CVE-2019-12255 CVE-2019-12260+8 CVEs

60

Critical Flaws Found in VxWorks RTOS That Powers Over 2 Billion Devices

The Hacker NewsJul 29, 16:19 UTC · Jul 29, 2019Exploit / PoC CVE-2019-12256 CVE-2019-12255 CVE-2019-12260+8 CVEs

60

Urgent11 flaws affect more medical, industrial devices than previously thought

Help Net SecurityFeb 11, 12:31 UTC · Feb 11, 2021Vulnerability CVE-2019-12255 CVE-2019-12262

47

Report: Nearly 75% of Infusion Pumps Affected by Severe Vulnerabilities

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2022Vulnerability CVE-2019-12255 CVE-2019-12264 CVE-2016-9355+7 CVEs

35