← Vulnerability feed

Vulnerability record · CVE-2020-25109 · published 11 December 2020

CVE-2020-25109: Ethernut Nut/OS DNS header count out-of-bounds read

Ethernut · Nut\/Os

The DNS implementation in Ethernut Nut/OS 5.1 does not validate the query/response count in the DNS header against the actual data present, causing an out-of-bounds read. This can lead to a denial of service and possibly remote code execution on affected embedded devices.

9.8 CVSS 3.1 Critical EPSS 54% · top 1.0% CWE-125 · Out-of-bounds read
9.8CVSS 3.1 base score, v2 7.5
54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set in a DNS header) is not checked against the data present. This may lead to successful Denial-of-Service, and possibly Remote Code Execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 9.8 critical severity and high EPSS probability, but no confirmed exploitation or KEV listing and limited product exposure.

What it is

The DNS implementation in Ethernut Nut/OS 5.1 does not validate the query/response count in the DNS header against the actual data present, causing an out-of-bounds read. This can lead to a denial of service and possibly remote code execution on affected embedded devices.

Impact

An unauthenticated remote attacker can crash or destabilize the DNS resolver, and the out-of-bounds read may be leveraged for code execution on the device.

Attack surface

Reachable over the network via crafted DNS packets sent to the vulnerable DNS implementation; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS indicates a high 30-day exploitation probability (0.53699, 98.9th percentile), but the record contains no confirmed in-the-wild exploitation.

What to do

  • Apply the vendor fix or update referenced in the CISA ICS advisory ICSA-20-343-01 for Nut/OS 5.1.
  • If patching is not possible, restrict network access to DNS services on affected devices using firewall rules or network segmentation.
  • Disable or limit the DNS resolver functionality on devices that do not require it.
  • Monitor vendor and CERT/CC advisories for updated guidance and patches.

Detection

  • Monitor network traffic for malformed DNS packets with header counts inconsistent with payload length.
  • Watch for repeated device crashes, reboots, or DNS service failures on Nut/OS 5.1 devices.
  • Use IDS/IPS signatures targeting DNS header count anomalies against embedded DNS resolvers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 Third Party AdvisoryUS Government Resource
https://www.kb.cert.org/vuls/id/815128 Third Party AdvisoryUS Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01 Third Party AdvisoryUS Government Resource
https://www.kb.cert.org/vuls/id/815128 Third Party AdvisoryUS Government Resource

Track CVE-2020-25109 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-25107Nut/OS DNS resolver missing null-termination check allows DoS and possible RCEThe DNS implementation in Ethernut Nut/OS 5.1 does not verify that a domain name is '\0' terminated, an out-of-bounds read condition. A malformed DNS…EPSS 54%analysed9.8CVE-2020-25108Ethernut Nut/OS DNS response length flaw allows out-of-bounds writeThe DNS implementation in Ethernut Nut/OS 5.1 does not validate the length field of DNS response data, so a packet can set an arbitrary length. This …EPSS 54%analysed9.8CVE-2020-25110Ethernut Nut/OS DNS length byte flaw allows denial of service and possible RCEThe DNS implementation in Ethernut Nut/OS 5.1 fails to validate the length byte of a domain name in DNS queries and responses, then uses that value f…EPSS 54%analysed7.5CVE-2020-27213Ethernut nut\/os vulnerabilityAn issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an i…EPSS 0.97%8.8CVE-2026-11645Google Chrome V8 out-of-bounds read and write enables sandbox code executionGoogle Chrome before 149.0.7827.103 contains an out-of-bounds read and write in the V8 JavaScript engine. A crafted HTML page can trigger the memory …KEVEPSS 2.2%analysed7.8CVE-2023-36424Windows Common Log File System Driver out-of-bounds read privilege escalationCVE-2023-36424 is an out-of-bounds read (CWE-125) in the Windows Common Log File System (CLFS) driver that allows elevation of privilege. It affects …KEVEPSS 12%analysed9.3CVE-2026-3055Citrix NetScaler ADC and Gateway SAML IDP memory overreadNetScaler ADC and NetScaler Gateway, when configured as a SAML identity provider, fail to validate input sufficiently, causing an out-of-bounds memor…KEVEPSS 4.0%analysed9.3CVE-2025-5777Citrix NetScaler ADC/Gateway memory overread via insufficient input validationCVE-2025-5777 is an insufficient input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that causes a memory overread when the appliance…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2020-25109), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.