CVE-2020-10019 - CVE House
Back to Database
Status published High CVE-2020-10019

Buffer Overflow in USB DFU requested length

Vulnerability Description

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. This could be used by a malicious USB host to exploit the buffer overflow. See NCC-ZEP-002 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10019

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • NCC Group for report

References

More from zephyrproject-rtos

View All →
CVE-2025-9558
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start
High 7.6
CVE-2025-9557
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
High 7.6
CVE-2025-9408
Userspace privilege escalation vulnerability on Cortex M
High 8.2
CVE-2025-7403
Bluetooth: bt_conn_tx_processor unsafe handling
High 7.6
CVE-2025-2962
Infinite loop in dns_copy_qname
High 8.2

Affected Vendor

zephyrproject-rtos

View all reports →

Affected Software

zephyr
Vulnerable Versions:
1.14.1, 2.1.0

Timeline

Official Publish: May 11th, 2020
Last Modified: September 17th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-120

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control