fkie_nvd - fkie_cve-2025-26500

fkie_cve-2025-26500

Vulnerability from fkie_nvd

Published

2025-03-21 23:15

Modified

2025-03-21 23:15

Severity ?

4.6 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

: Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets may lead to the system becoming unavailable This issue affects VxWorks 7: from 22.06 through 24.03.

References

▼	URL	Tags
	0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8	https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26500

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": ": Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.\u00a0\u00a0\n\nSpecifically crafted USB packets may lead to the system becoming unavailable\n\nThis issue affects VxWorks 7: from 22.06 through 24.03."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de consumo incontrolado de recursos en Wind River Systems VxWorks 7 permite una asignaci\u00f3n excesiva. Los paquetes USB manipulados espec\u00edficamente pueden provocar la indisponibilidad del sistema. Este problema afecta a VxWorks 7 desde la versi\u00f3n 22/06 hasta la 24/03."
    }
  ],
  "id": "CVE-2025-26500",
  "lastModified": "2025-03-21T23:15:21.327",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-21T23:15:21.327",
  "references": [
    {
      "source": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
      "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26500"
    }
  ],
  "sourceIdentifier": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
      "type": "Secondary"
    }
  ]
}

CVE-2025-26500 (GCVE-0-2025-26500)

Vulnerability from cvelistv5

Published

2025-03-21 22:20

Modified

2025-03-24 13:19

Severity ?

4.6 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Summary

: Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets may lead to the system becoming unavailable This issue affects VxWorks 7: from 22.06 through 24.03.

References

▼	URL	Tags
	https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26500

Impacted products

	Vendor	Product	Version
	Wind River Systems	VxWorks 7	Version: 22.06

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T13:19:25.092364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T13:19:36.412Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "VxWorks"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Systems",
          "versions": [
            {
              "lessThanOrEqual": "24.03",
              "status": "affected",
              "version": "22.06",
              "versionType": "date"
            }
          ]
        }
      ],
      "datePublic": "2025-03-17T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.\u0026nbsp;\u0026nbsp;\n\nSpecifically crafted USB packets may lead to the system becoming unavailable\n\n\u003cp\u003eThis issue affects VxWorks 7: from 22.06 through 24.03.\u003c/p\u003e"
            }
          ],
          "value": ": Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.\u00a0\u00a0\n\nSpecifically crafted USB packets may lead to the system becoming unavailable\n\nThis issue affects VxWorks 7: from 22.06 through 24.03."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "None that are known.\u0026nbsp;"
            }
          ],
          "value": "None that are known."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-21T22:20:36.101Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26500"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support2.windriver.com/index.php?page=cve\u0026amp;on=view\u0026amp;id=CVE-2025-26500\"\u003ehttps://support2.windriver.com/index.php?page=cve\u0026amp;on=view\u0026amp;id=CVE-2025-26500\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26500"
        }
      ],
      "source": {
        "advisory": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE",
        "defect": [
          "Internal Testing"
        ],
        "discovery": "INTERNAL"
      },
      "title": "VxWorks 7 USB Failure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2025-26500",
    "datePublished": "2025-03-21T22:20:36.101Z",
    "dateReserved": "2025-02-11T20:11:10.092Z",
    "dateUpdated": "2025-03-24T13:19:36.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.