CVE-2020-10019CWE-120

Buffer Overflow in USB DFU requested length

High · published May 11, 2020

CVSS v3.1
8.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2020-05-11T22:26Z
EPSS history
Timeline
  • 11 MAY 22:26Z
    Buffer Overflow in USB DFU requested length
    cvelistv5