What’s Vulnerable › Vulnerabilities

CVE-2016-20009

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-11 · updated 2026-06-17
• Weakness: CWE-787

Description

A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• Siemens Sgt-100 Firmware: all versions
• Siemens Sgt-200 Firmware: all versions
• Siemens Sgt-300 Firmware: all versions
• Siemens Sgt-400 Firmware: all versions
• Siemens Sgt-A20 Firmware: all versions
• Siemens Sgt-A35 Firmware: all versions
• Siemens Sgt-A65 Firmware: all versions
• Windriver Vxworks: from 6.5 through 7.0

References

• https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/
• https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf
• https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/
• https://cert-portal.siemens.com/productcert/pdf/ssa-553445.pdf

Get alerted when CVE-2016-20009 or the next vulnerability affects your stack