CVE-2020-25928

CRITICAL

Hcc-embedded Nichestack Tcp/ip - Out-of-Bounds Write

Title source: rule
STIX 2.1

Description

The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall(), getoffset(), dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the "response data length" field of individual DNS answers, which may cause out-of-bounds read/write operations, leading to Information leak, Denial-or-Service, or Remote Code Execution, depending on the context.

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/608209

Scores

CVSS v3 9.8
EPSS 0.0596
EPSS Percentile 90.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-125 CWE-787
Status published
Products (1)
hcc-embedded/nichestack_tcp\/ip 4.0.1
Published Aug 18, 2021
Tracked Since Feb 18, 2026