Arm Mbed OS vulnerabilities

6 CVEs affecting Arm Mbed OS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-48984, published 2024-11-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-12883, published 2020-06-18. Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days. Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP…
CVE-2020-12886, published 2020-06-18. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the…
CVE-2020-12884, published 2020-06-18. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function…
CVE-2020-12885, published 2020-06-18. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function…
CVE-2024-48984, published 2024-11-20. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then…
CVE-2024-22905, published 2024-04-19. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSerialRxIncoming function.