Skip to content
Fencer Vulns
critical 9.8

CVE-2020-17438 in the critical feed json

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products.

published 2020-12-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-9391

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.3%
EPSS 19.3% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented packets fails to properly validate the total length of an incoming packet specified in its IP header, as well as the fragmentation offset value specified in the IP header. By crafting a packet with specific values of the IP header length and the fragmentation offset, attackers can write into the .bss section of the program (past the statically allocated buffer that is used for storing the fragmented data) and cause a denial of service in uip_reass() in uip.c, or possibly execute arbitrary code on some target architectures.

Patch / fix

  • open-iscsi SLE Module for Basesystem 15 SP2, SLE Micro 5.0 2.1.4-22.14.1
  • open-iscsi SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.0.876-13.42.1
  • open-iscsi SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2.0.876-12.27.2

suse advisories SUSE-RU-2021:1517-1SUSE-SU-2021:1164-1SUSE-SU-2021:0663-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-343-01 updated cvss 7.0

Multiple Embedded TCP/IP Stacks

  • multiple open source FNET 4.6.3 multiple open source Nut/Net <= 5.1 multiple open source open-iscsi <= 2.1.12 multiple open source picoTCP (EOL) <= 1.7.0 multiple open source picoTCP-NG <= 1.7.0 multiple open source uIP (EOL) <= 1.0
    +2 more products
    multiple open source uIP-Contiki-NG <= 4.5 multiple open source uIP-Contiki-OS (end-of-life [EOL]) <= 3.0
    affected: vendor fix yanzi.dev

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

19.29% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.