CVE-2018-16598

mediumpriority · track · 25EPSS 0.015 · 74 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.52% (74th) EPSS

CVSS 4.3 · medium

Is it mine?

17 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · sick_psirt

EPSS · scored 2026-10-27

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request.

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 3.6

v3.05.4mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · SICK PSIRT DE

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-441USprimaryCWE-441US

affected products (17)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
amazon amazon web services freertos≤ 1.3.1nvdUScpe:2.3:a:amazon:amazon_web_services_freertos:*:*:*:*:*:*:*:*
amazon freertos≤ 10.0.1nvdUScpe:2.3:a:amazon:freertos:*:*:*:*:*:*:*:*
SICK ANM58B all Firmware versionsall versionsnot affectedsick_psirtDE
SICK ANS58B all Firmware versionsall versionsnot affectedsick_psirtDE
SICK DCM4 with Firmware 1.2.0 up to 1.4.0all versionsnot affectedsick_psirtDE
SICK DMM4 with Firmware 1.2.0 up to 1.4.0all versionsnot affectedsick_psirtDE
SICK FXL1 with Firmware 1.6.0 up to 1.21.0all versionsnot affectedsick_psirtDE
SICK SE1 with Firmware 1.16.0 up to 1.17.0all versionsnot affectedsick_psirtDE
SICK deTec4 with Firmware 1.05 up to 1.51.0all versionsnot affectedsick_psirtDE
SICK deTem2 Core A/P with Firmware 1.04 up to 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 A/P with Firmware 1.02 up to 1.32.0all versionsnot affectedsick_psirtDE
SICK deTem4 Core A/P with Firmware 1.04 up to 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 LT Muting A/P with Firmware 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 with Firmware 1.02 up to 1.3.0all versionsnot affectedsick_psirtDE
SICK safeVisionary2 all Firmware versionsall versionsnot affectedsick_psirtDE
SICK scanGrid2 with Firmware 1.10 up to 1.15all versionsnot affectedsick_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

SCA-2025-0003FreeRTOS Vulnerabilities have no impact on SICK Products2025-02-28csaf · sick_psirtDE
FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd sick_psirt NVD CVE.org MITRE

published 2018-12-06modified 2026-06-17

related (242)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-83548US	—OT critical	8.04% (95th)	KEV	2026-09-01
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could pot…
CVE-2004-2289US	high10.0	23.3% (98th)	Exploit	2004-12-31
Microsoft Windows XP Explorer allows local users to execute arbitrary code via a system folder with a Desktop.ini file containing a .ShellClassInfo specifier with a CLSID value tha…
CVE-2024-23739US	critical9.8	1.79% (78th)	Exploit	2024-01-28
An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
CVE-2019-3924US	high7.5	15.7% (97th)	Exploit	2019-02-20
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WA…
CVE-2026-100706US	critical9.9	0.61% (49th)	—	2026-09-26
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create object…

+237 more

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan