CVE-2020-25110: Ethernut Nut/OS DNS length byte flaw allows denial of service and possible RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and possible remote code execution, plus a high EPSS score, make this a critical risk for exposed Nut/OS devices.

What it is

The DNS implementation in Ethernut Nut/OS 5.1 fails to validate the length byte of a domain name in DNS queries and responses, then uses that value for internal memory operations. This unchecked length can cause out-of-bounds memory access, leading to denial of service and possibly remote code execution. The flaw is remotely reachable over the network with no authentication or user interaction.

Impact

An attacker can crash or destabilize the device via malformed DNS traffic, and may be able to execute arbitrary code in the context of the DNS handling process. Successful exploitation could give full control of the affected embedded system.

Attack surface

Reachable over the network through DNS query or response processing (CVSS AV:N, PR:N, UI:N). No authentication or user interaction is required; any host able to send DNS traffic to the device can trigger the flaw.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is high (0.537, 98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Patch or upgrade Nut/OS to a version that validates DNS domain name length bytes before using them in memory operations; consult the Ethernut/CISA ICSA-20-343-01 advisory for fixed builds.
• If no patch is available, restrict DNS traffic to trusted sources and disable DNS client/server functionality where not required.
• Segment affected embedded devices from untrusted networks and block inbound DNS from external or guest networks.
• Monitor vendor advisories for updated firmware and apply compensating network controls until patched.

Detection

• Inspect DNS traffic for domain name length bytes that exceed expected label or name limits, especially malformed or truncated names.
• Monitor device logs and network telemetry for repeated DNS parsing errors, crashes, or unexpected reboots of Nut/OS devices.
• Alert on DNS packets with anomalous length fields or oversized labels targeting embedded devices on the network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.