Vulnerability · Published May 12, 2020 · Assigned by apache
CVE-2020-1939
Critical 9.8
In plain English
A critical-severity security flaw in Apache NuttX (incubating). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.6%top 14.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache NuttX (incubating) | Apache NuttX (incubating) 6.15 to 8.2 |