What is CVE-2020-1939?

CVE-2020-1939 is a critical-severity vulnerability in Apache Nuttx, classified under NULL Pointer Dereference. CVSS score: 9.8/10. Published 2020-05-12.

How severe is CVE-2020-1939?

Critical severity. CVSS v3 base score is 9.8 out of 10.

NULL pointer dereference in Apache Nuttx

CVE-2020-1939

The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.

EPSS: 0.025 (83.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Nuttx
N/a Apache Nuttx (Incubating) — versions Apache NuttX (incubating) 6.15 to 8.2

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

References

security@apache.org (Patch, Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-1939?: CVE-2020-1939 is a critical-severity vulnerability in Apache Nuttx, classified under NULL Pointer Dereference. CVSS score: 9.8/10. Published 2020-05-12.
How severe is CVE-2020-1939?: Critical severity. CVSS v3 base score is 9.8 out of 10.