CVE-2020-25108

CRITICAL

Ethernut Nut/OS < 5.1 - Out-of-bounds Write in DNS Response Handler

Title source: llm

Description

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checked (it can be set to an arbitrary value from a packet). This may lead to successful Denial-of-Service, and possibly Remote Code Execution.

References (2)

Core 2

Core References

Third Party Advisory, US Government Resource x_refsource_misc

https://www.kb.cert.org/vuls/id/815128

Third Party Advisory, US Government Resource x_refsource_misc

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01

Scores

CVSS v3 9.8

EPSS 0.5226

EPSS Percentile 98.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (1)

ethernut/nut\/os < 5.1

Published Dec 11, 2020

Tracked Since Feb 18, 2026