CVE-2019-12255: VxWorks IPNET TCP urgent pointer integer underflow buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, high EPSS and a public exploit make this a top remediation priority despite no KEV listing.

What it is

Wind River VxWorks contains a buffer overflow in the TCP component of its IPNET network stack, triggered by a TCP Urgent Pointer value of 0 that causes an integer underflow. It is one of four related IPNET TCP issues and affects VxWorks as well as products from NetApp, SonicWall, Siemens, Belden and others that embed the stack. Because the flaw sits in the TCP stack itself, it matters to any network-exposed device running the affected code.

Impact

An unauthenticated remote attacker can corrupt memory in the TCP processing path, which can lead to code execution or a denial of service on the affected device. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via TCP traffic to the affected stack; the CVSS vector shows no privileges and no user interaction required. Any host that accepts TCP connections with the vulnerable IPNET stack is in scope.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.7525 (99.5th percentile) and a public Packet Storm exploit reference exists, indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor patches from Wind River and each downstream vendor (Siemens, SonicWall, NetApp, Belden/Hirschmann) for affected products.
• Where patching is not yet possible, restrict or filter TCP traffic to affected devices and segment them from untrusted networks.
• Disable or block unnecessary TCP services on embedded and OT devices running the affected stack.
• Monitor vendor advisories for updated firmware and track which of your assets use the affected IPNET stack.

Detection

• Inspect network traffic for TCP segments with an urgent pointer of 0 or malformed urgent-pointer handling against affected hosts.
• Monitor affected devices for unexpected crashes, reboots or process restarts that could indicate exploitation attempts.
• Alert on IDS/IPS signatures covering the public VxWorks IPNET TCP urgent pointer exploit.
• Baseline normal TCP behavior for OT/embedded assets and flag anomalous urgent-pointer or malformed TCP packets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.