CVE-2020-25110

critical · 9.8

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations. This may lead to successful Denial-of-Service, and possibly Remote Code Execution.

9.8

CVSS

53.7%

EPSS (exploit prob.)

99th

EPSS percentile

2020-12-11

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-125

Affected products

Vendor	Product	Affected versions
ethernut	nut/os	<= 5.1

Check a specific version with /api/v1/cve/match.

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
https://www.kb.cert.org/vuls/id/815128
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
https://www.kb.cert.org/vuls/id/815128

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-25110