CVE-2020-17443
mediumpriority · track · 31stack campaign · AMNESIA:33EPSS 0.028 · 87 %ileDEEUUSEPSS · scored 2026-10-27
An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6 echo request packet's size is shorter than 8 bytes. If the size of the incoming ICMPv6 request packet is shorter than this, the operation that calculates the size of the ICMPv6 echo replies has an integer wrap around, leading to memory corruption and, eventually, Denial-of-Service in pico_icmp6_send_echoreply_not_frag in pico_icmp6.c.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedFNETcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixedNut/Netcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - Fixedopen-iscsicisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixedpicoTCP (EOL)cisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixedpicoTCP-NGcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixeduIP (EOL)cisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixeduIP-Contiki-NGcisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08 - FixeduIP-Contiki-OS (end-of-life [EOL])cisa_csaf_ot
Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:
https://yanzi.dev/#/security/advisories/2020-12-08
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–8.2
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
- Unify OpenScape Common Management Platformall versionscert_bundDEcpe:/a:unify:openscape_common_management_platform:-
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-1044TCP/IP Stack: Mehrere SchwachstellenDeutsch2020-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in TCP/IP Stack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, einen Denial of Service Angriff durchzuführen, vertrauliche Daten einzusehen oder Daten zu manipulieren.
- ICSA-20-343-01Multiple Embedded TCP/IP Stacks2020-12-08icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow attackers to corrupt memory, put devices into infinite loops, access unauthorized data, and/or poison DNS cache.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2020-17443cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.4363/cnnvd
- https://www.kb.cert.org/vuls/id/815128cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01enisa_euvd
- https://www.kb.cert.org/vuls/id/815128enisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party AdvisoryUS Government Resourcenvd
- https://www.kb.cert.org/vuls/id/815128Third Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan