CVE-2010-2965: Wind River VxWorks WDB Debug Agent Missing Authorization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication required and high EPSS percentile indicates severe risk of remote compromise.

What it is

The WDB target agent debug service in Wind River VxWorks 6.x, 5.x and earlier, including Rockwell Automation 1756-ENBT series A firmware 3.2.6 and 3.6.1, fails to properly authorize requests to UDP port 17185. This allows remote attackers to read or modify arbitrary memory, invoke functions, or manage tasks on the device. The flaw is a related issue to CVE-2005-3804 and carries a CVSS 3.1 base score of 9.8 (critical).

Impact

An unauthenticated remote attacker can read or modify arbitrary memory locations, execute function calls, and manage tasks on the affected device. This effectively grants full control over the target system, enabling code execution, data theft, or denial of service.

Attack surface

The vulnerability is reachable over the network via UDP port 17185, the WDB debug service. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a 30-day exploitation probability of 0.578 (99th percentile), suggesting high likelihood of active exploitation. Reference tags include 'Not Applicable' and 'Permissions Required', with no explicit exploit availability noted.

What to do

• Apply the latest firmware updates from Wind River and Rockwell Automation for VxWorks and the 1756-ENBT series A.
• Disable or block the WDB debug service (UDP port 17185) on all affected devices unless absolutely required.
• Segment industrial control networks to restrict access to UDP port 17185 from untrusted networks.
• Monitor vendor advisories and CERT/CC guidance for additional mitigations.
• If patching is not possible, consider network-level filtering and intrusion prevention signatures for WDB traffic.

Detection

• Monitor network traffic for UDP port 17185 to identify unexpected WDB debug service communications.
• Inspect device logs for unauthorized memory access or task management commands via the WDB agent.
• Use network intrusion detection systems to alert on known WDB exploitation patterns or anomalous UDP payloads.
• Audit exposed UDP services on VxWorks-based devices to ensure the WDB agent is not unnecessarily reachable.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.