{"id":"CVE-2020-10060","aliases":["EUVD-2020-2525","GHSA-435h-hqgw-fqgf"],"status":"published","title":"UpdateHub Might Dereference An Uninitialized Pointer","description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01559,"percentile":0.75429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-824"],"published":"2020-05-11T22:26:16Z","modified":"2026-06-17T02:47:16Z","products":[{"vendor":"zephyrproject","product":"zephyr"},{"vendor":"zephyrproject-rtos","product":"zephyr"}],"references":[{"url":"https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-37","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://docs.zephyrproject.org/latest/security/vulnerabilities.html#cve-2020-10060","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27865","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27889","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27891","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://github.com/zephyrproject-rtos/zephyr/pull/27893","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10060"},{"url":"https://docs.zephyrproject.org/latest/security/vulnerabilities.html#CVE-2020-10060"},{"url":"https://github.com/advisories/GHSA-435h-hqgw-fqgf"}],"sources":{"cve":[{"id":"CVE-2020-10060","title":"UpdateHub Might Dereference An Uninitialized Pointer","description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","status":"published","published":"2020-05-11T22:26:16.934Z","modified":"2024-09-16T23:31:11.924Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-2525","description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","status":"published","published":"2020-05-11T22:26:16Z","modified":"2024-09-16T23:31:11Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:54:49.761845Z"}],"ghsa":[{"id":"GHSA-435h-hqgw-fqgf","title":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output...","description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Recommend disabling updatehub until such a time as a fix can be made available. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","status":"published","published":"2022-05-24T17:17:40Z","modified":"2023-01-29T05:02:37Z","cwes":["CWE-824"],"updated_at":"2026-11-02T14:45:08.066233Z"}],"nvd":[{"id":"CVE-2020-10060","description":"In updatehub_probe, right after JSON parsing is complete, objects\\[1] is accessed from the output structure in two different places. If the JSON contained less than two elements, this access would reference unitialized stack memory. This could result in a crash, denial of service, or possibly an information leak. Provided the fix in CVE-2020-10059 is applied, the attack requires compromise of the server. See NCC-ZEP-030 This issue affects: zephyrproject-rtos zephyr version 2.1.0 and later versions. version 2.2.0 and later versions.","status":"published","published":"2020-05-11T23:15:12.02Z","modified":"2026-06-17T02:47:16.557Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-824"],"updated_at":"2026-11-02T14:06:00.784809Z"}]}}