What’s Vulnerable › Vulnerabilities

CVE-2015-7599

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-02-07 · updated 2026-06-17
• Weakness: CWE-190

Description

Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.

Affected products

• Windriver Vxworks: through 6.9.4.1; 5.5, 6.4, 6.7, 6.8, 6.9

References

• http://blogs.windriver.com/wind_river_blog/2015/09/wind-river-vxworks-updateclarification.html
• http://www.securityfocus.com/bid/79205
• https://kb.netapp.com/support/s/article/cve-2015-7599-vxworks-vulnerability-impacting-netapp-e-series-products?language=en_US
• https://security.netapp.com/advisory/ntap-20151029-0001/
• https://www.syscan360.org/slides/2015_EN_AttackingVxWorksFromstoneagetointerstellar_Eric_Yannick.pdf
• http://blogs.windriver.com/wind_river_blog/2015/09/wind-river-vxworks-updateclarification.html
• http://www.securityfocus.com/bid/79205
• https://kb.netapp.com/support/s/article/cve-2015-7599-vxworks-vulnerability-impacting-netapp-e-series-products?language=en_US
• https://security.netapp.com/advisory/ntap-20151029-0001/
• https://www.syscan360.org/slides/2015_EN_AttackingVxWorksFromstoneagetointerstellar_Eric_Yannick.pdf

Get alerted when CVE-2015-7599 or the next vulnerability affects your stack