Denial-of-Service and Potential Remote Code Execution in Ethernut DNS Implementation
CVE-2020-25107

9.8CRITICAL

Key Information:

Vendor

Ethernut

Status
Nut\/os
Vendor
CVE Published:
11 December 2020

What is CVE-2020-25107?

A vulnerability has been identified in the DNS implementation within Ethernut's Nut/OS 5.1 version, where the absence of termination checks on domain names can lead to Denial-of-Service attacks. This lack of validation may also allow for potential Remote Code Execution, exposing systems to further risks. It's critical for users to assess their systems and apply necessary mitigations to safeguard against these threats.

References

https://www.kb.cert.org/vuls/id/815128
x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
x_refsource_MISC

EPSS Score

53% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.