Skip to content
Fencer Intel
high 8.2

CVE-2020-17437 json

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products.

published 5y ago modified 4mo ago also EUVD-2020-9390

cvss
8.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.

Patch / fix

  • siemens sentron_3va_com100_firmware 4.4.1
  • siemens sentron_3va_com800_firmware 4.4.1
  • siemens sentron_3va_dsp800_firmware 4.0
  • siemens sentron_pac2200_firmware 3.2.2
  • siemens sentron_pac3200_firmware 2.4.7
  • siemens sentron_pac3200t_firmware 3.2.2
  • siemens sentron_pac3220_firmware 3.2.0
  • siemens sentron_pac4200_firmware 2.3.0
  • open-iscsi Debian 14, Debian 13, Debian 12 2.1.3-1

debian advisories DEBIAN-CVE-2020-17437

  • open-iscsi Ubuntu 20.04 LTS 2.0.874-7.1ubuntu6.4
  • open-iscsi Ubuntu Pro 16.04 LTS 2.0.873+git0.3b4b4500-14ubuntu3.7+esm1
  • open-iscsi Ubuntu Pro 18.04 LTS 2.0.874-5ubuntu2.11+esm1

ubuntu advisories UBUNTU-CVE-2020-17437

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • open-iscsi SLES 12 SP2-BCL 2.0.873-46.17.2
  • open-iscsi SLES 12 SP3-BCL 2.0.876-53.34.1
  • open-iscsi SLE Module for Basesystem 15 SP2, SLE Micro 5.0 2.1.4-22.14.1
  • open-iscsi SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.0.876-13.42.1
  • open-iscsi SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2.0.876-12.27.2

suse advisories SUSE-SU-2022:2861-1SUSE-SU-2022:2806-1SUSE-RU-2021:1517-1SUSE-SU-2021:1164-1SUSE-SU-2021:0663-1

  • open-iscsi openSUSE Tumbleweed 2.1.5-80.2

opensuse advisories openSUSE-SU-2024:11112-1

Is CVE-2020-17437 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-17437 updated cvss 5.3

Open-iSCSI: invalid handing of the TCP urgent data pointer

  • Red Hat Enterprise Linux 5 iscsi-initiator-utils Red Hat Enterprise Linux 6 iscsi-initiator-utils
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio Red Hat Enterprise Linux 8 iscsi-initiator-utils, python3-iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio Red Hat Enterprise Linux 9 iscsi-initiator-utils, python3-iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-21-068-06 updated cvss 6.5

Siemens TCP/IP Stack Vulnerabilities-AMNESIA:33 in SENTRON PAC / 3VA Devices (Update C)

show 1 more

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-20-343-01 updated cvss 8.2

Multiple Embedded TCP/IP Stacks

  • multiple open source FNET 4.6.3 multiple open source Nut/Net <= 5.1 multiple open source open-iscsi <= 2.1.12 multiple open source picoTCP (EOL) <= 1.7.0 multiple open source picoTCP-NG <= 1.7.0 multiple open source uIP (EOL) <= 1.0
    +2 more products
    multiple open source uIP-Contiki-NG <= 4.5 multiple open source uIP-Contiki-OS (end-of-life [EOL]) <= 3.0
    affected: vendor fix yanzi.dev

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.86% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.