Out-of-bounds write in VxWorks - CVE-2020-28895

Vulnerability identifier: #VU75043

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28895

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.

VxWorks
SCALANCE X308-2M TS
SIPLUS NET SCALANCE X308-2
SCALANCE XR324-12M TS
SCALANCE XR324-12M
SCALANCE XR324-4M POE TS
SCALANCE XR324-4M POE
SCALANCE XR324-4M EEC
SCALANCE X310FE
SCALANCE X310
SCALANCE X308-2M POE
SCALANCE X308-2M
SCALANCE X308-2LH+
SCALANCE X308-2LH
SCALANCE X308-2LD
SCALANCE X308-2
SCALANCE X307-3LD
SCALANCE X307-3
SCALANCE X408-2
SCALANCE X320-1-2LD FE
SCALANCE X320-1 FE
SCALANCE X302-7 EEC
SCALANCE X307-2 EEC
SCALANCE X306-1LD FE
SCALANCE X304-2FE
SCALANCE X204-2TS
SCALANCE X212-2LD
SCALANCE X212-2
SCALANCE X208PRO
SCALANCE X208
SCALANCE X206-1LD
SCALANCE X206-1
SCALANCE XF204-2
SCALANCE X216
SCALANCE X204-2LD TS
SCALANCE X204-2LD
SCALANCE X204-2FM
SCALANCE X204-2
SCALANCE X224
SCALANCE XF206-1
SCALANCE XF208
SCALANCE XF204
SCALANCE XF204-2BA IRT
SIPLUS NET SCALANCE X202-2P IRT
SCALANCE XF204IRT
SCALANCE X200-4P IRT
SCALANCE XF202-2P IRT
SCALANCE XF201-3P IRT
SCALANCE X204IRT PRO
SCALANCE X204IRT
SCALANCE X202-2P IRT PRO
SCALANCE X202-2P IRT
SCALANCE X202-2IRT
SCALANCE X201-3P IRT

Install updates from vendor's website.

VxWorks - addressed in versions 6.9.4.12 RCPL3, 21.03
SCALANCE X204-2TS - update to 5.2.6
SCALANCE X212-2LD - update to 5.2.6
SCALANCE X212-2 - update to 5.2.6
SCALANCE X208PRO - update to 5.2.6
SCALANCE X208 - update to 5.2.6
SCALANCE X206-1LD - update to 5.2.6
SCALANCE X206-1 - update to 5.2.6
SCALANCE XF204-2 - update to 5.2.6
SCALANCE X216 - update to 5.2.6
SCALANCE X204-2LD TS - update to 5.2.6
SCALANCE X204-2LD - update to 5.2.6
SCALANCE X204-2FM - update to 5.2.6
SCALANCE X204-2 - update to 5.2.6
SCALANCE X224 - update to 5.2.6
SCALANCE XF206-1 - update to 5.2.6
SCALANCE XF208 - update to 5.2.6
SCALANCE XF204 - update to 5.2.6
SCALANCE XF204-2BA IRT - update to 5.5.2
SIPLUS NET SCALANCE X202-2P IRT - update to 5.5.2
SCALANCE XF204IRT - update to 5.5.2
SCALANCE X200-4P IRT - update to 5.5.2
SCALANCE XF202-2P IRT - update to 5.5.2
SCALANCE XF201-3P IRT - update to 5.5.2
SCALANCE X204IRT PRO - update to 5.5.2
SCALANCE X204IRT - update to 5.5.2
SCALANCE X202-2P IRT PRO - update to 5.5.2
SCALANCE X202-2P IRT - update to 5.5.2
SCALANCE X202-2IRT - update to 5.5.2
SCALANCE X201-3P IRT - update to 5.5.2 SCALANCE X201-3P IRT PRO

• https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895
• https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327
• https://www.oracle.com/security-alerts/cpuapr2022.html

• Out-of-bounds write in Wind River VxWorks
• Multiple vulnerabilities in Siemens SCALANCE X-200, X-200IRT and X-300 Switch Families