CVE-2020-25107: Nut/OS DNS resolver missing null-termination check allows DoS and possible RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network-reachable, unauthenticated impact and a high EPSS score, though no confirmed in-the-wild exploitation is recorded.

What it is

The DNS implementation in Ethernut Nut/OS 5.1 does not verify that a domain name is '\0' terminated, an out-of-bounds read condition. A malformed DNS response can crash the device and, per the advisory, may allow remote code execution, which matters for embedded and ICS deployments running this stack.

Impact

An attacker can cause a denial of service against the affected device and potentially execute code remotely, giving full loss of confidentiality, integrity and availability per the CVSS vector.

Attack surface

Reachable over the network via DNS traffic (AV:N, PR:N, UI:N); no authentication or user interaction is required, so any host able to deliver a crafted DNS response to the resolver can trigger it.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware association is recorded, but EPSS is high at roughly 0.537 (98.9th percentile), indicating elevated predicted exploitation likelihood.

What to do

• Apply the vendor fix or the mitigations in CISA ICS advisory ICSA-20-343-01 and CERT/CC VU#815128; patch first.
• If no fix is available, restrict DNS traffic to trusted resolvers and segment affected devices from untrusted networks.
• Disable or avoid the vulnerable DNS resolver on Nut/OS 5.1 devices where it is not required.
• Monitor vendor and CERT/CC advisories for updated firmware and re-check exposure after patching.

Detection

• Monitor device logs and network captures for crashes or resets of Nut/OS hosts following DNS responses.
• Inspect DNS response traffic to embedded devices for malformed or non-null-terminated domain names.
• Watch for unexpected outbound connections or anomalous behavior from affected devices that could indicate code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.