Siemens Siprotec 5 Firmware vulnerabilities

9 CVEs affecting Siemens Siprotec 5 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-12261, published 2019-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-12257, published 2019-08-09. High severity, CVSS 8.8. EPSS: 84.2% chance of exploitation in the next 30 days. Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
CVE-2019-12255, published 2019-08-09. Critical severity, CVSS 9.8. EPSS: 75.1% chance of exploitation in the next 30 days. Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
CVE-2019-12265, published 2019-08-09. Medium severity, CVSS 5.3. EPSS: 59.8% chance of exploitation in the next 30 days. Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership…
CVE-2019-12256, published 2019-08-09. Critical severity, CVSS 9.8. EPSS: 26.6% chance of exploitation in the next 30 days. Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
CVE-2019-12260, published 2019-08-09. Critical severity, CVSS 9.8. EPSS: 23.3% chance of exploitation in the next 30 days. Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO…
CVE-2019-12258, published 2019-08-09. High severity, CVSS 7.5. EPSS: 22.8% chance of exploitation in the next 30 days. Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
CVE-2019-12259, published 2019-08-09. High severity, CVSS 7.5. EPSS: 15.9% chance of exploitation in the next 30 days. Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL dereference in IGMP parsing.
CVE-2019-12261, published 2019-08-09. Critical severity, CVSS 9.8. EPSS: 9% chance of exploitation in the next 30 days. Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a…
CVE-2019-12263, published 2019-08-09. High severity, CVSS 8.1. EPSS: 3.2% chance of exploitation in the next 30 days. Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.