CVE-2020-36244

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-10 · updated 2026-06-17
Weakness: CWE-787

Description

The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely execute arbitrary code on the DLT-Daemon (versions prior to 2.18.6).

Affected products

Debian Linux: 10.0
GENIVI Diagnostic Log And Trace: before 2.18.6 — fixed in 2.18.6

How to fix

Upgrade to a fixed version: GENIVI Diagnostic Log And Trace 2.18.6. Check the vendor advisory for mitigations.

References

https://github.com/GENIVI/dlt-daemon/compare/v2.18.5...v2.18.6
https://github.com/GENIVI/dlt-daemon/issues/265
https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html
https://us-cert.cisa.gov/ics/advisories/icsa-21-147-01
https://github.com/GENIVI/dlt-daemon/compare/v2.18.5...v2.18.6
https://github.com/GENIVI/dlt-daemon/issues/265
https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html
https://us-cert.cisa.gov/ics/advisories/icsa-21-147-01

Get alerted when CVE-2020-36244 or the next vulnerability affects your stack