PT-2020-12609 · Wind River · Vxworks

Published 2020-07-23 · Updated 2021-07-21 · CVE-2020-11440

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wind River VxWorks versions 5.5 through 7 SR0640

Description The issue is related to the httpRpmFs in WebCLI, which has no check for an escape from the web root. This allows for potential unauthorized access.

Recommendations For versions 5.5 through 7 SR0640, consider restricting access to the WebCLI to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-11440

Affected Products

Vxworks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-11440 · Security Note
• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-11440 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11440 · Vendor Advisory
• https://t.me/cibsecurity/13619 · Telegram Post
• https://windriver.com · Note