PT-2025-25490 · Apache · Apache Nuttx Rtos

Jianyuwang · Published 2025-06-14 · Updated 2025-06-16 · CVE-2025-47869

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NuttX RTOS versions 6.22 through 12.9.0

Description An issue was discovered in the Apache NuttX RTOS apps/examples/xmlrpc application, where a device stats structure stored remotely provided parameters with a hardcoded buffer size, potentially leading to a buffer overflow. The structure members' buffers were updated to a valid size of CONFIG XMLRPC STRINGSIZE+1. This issue may affect users who have based their code on the example application from releases prior to 12.9.0.

Recommendations For Apache NuttX RTOS versions 6.22 through 12.9.0, users are advised to review their code for the pattern of hardcoded buffer sizes and update the buffer sizes as presented in the example application in release 12.9.0.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-08200

CVE-2025-47869

Affected Products

Apache Nuttx Rtos

References · 12

• https://github.com/apache/nuttx-apps/pull/3027 · Patch
• https://lists.apache.org/thread/306qcqyc3bpb2ozh015yxjo9kqs4jbvj · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08200 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47869 · Vendor Advisory
• http://openwall.com/lists/oss-security/2025/06/14/2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47869 · Security Note
• https://t.me/cvenotify/125763 · Telegram Post
• https://t.me/latest_high_impact_cve/2677 · Telegram Post
• https://twitter.com/oss_security/status/1934032353711554950 · Twitter Post
• https://twitter.com/CVEnew/status/1934570404573823054 · Twitter Post
• https://twitter.com/transilienceai/status/1934101623745470562 · Twitter Post
• https://t.me/cvetracker/26302 · Telegram Post