CVE-2018-16601

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.16%

Published

Dec 6, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket, leading to denial of service and possibly remote code execution.

Weaknesses (CWE)

CWE-191

Affected Products (2)

amazon · amazon_web_services_freertosvulnerable

amazon · freertosvulnerable

References (6)

https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/

ExploitThird Party Advisory

https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/

Third Party Advisory

https://github.com/aws/amazon-freertos/blob/v1.3.2/CHANGELOG.md

Release NotesThird Party Advisory

https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-details/

ExploitThird Party Advisory

https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-range-devices-risk-compromise-smart-homes-critical-infrastructure-systems/

KEV Catalog EPSS Scores Vendors All CVEs