CVE-2019-12257

What it actually does

Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc component allowing remote code execution on affected systems.

Why it matters to the business

Compromise of embedded devices running the DHCP client can lead to full system takeover, network lateral movement, or operational disruption; high EPSS score signals elevated likelihood of exploitation despite lack of KEV listing.

How an attack unfolds

An attacker on the local network positions a rogue DHCP server and sends specially crafted Offer or ACK packets that trigger the heap overflow during parsing in the DHCP client, resulting in arbitrary code execution.

How to fix it

Upgrade golang/go (GIT) to the fixed commit 42b42f71cf8f5956c09e66230293dfb5db652360; apply vendor patches for VxWorks DHCP client if available and segment DHCP traffic.

How to confirm the fix worked

Verify the DHCP client binary or library version matches the patched commit; test with crafted DHCP packets in an isolated environment to confirm overflow handling.

Typical attack path

1. Gain access to the same broadcast domain as the target device
2. Deploy a malicious DHCP server responding to client requests
3. Transmit oversized or malformed DHCP Offer/ACK messages
4. Trigger heap overflow to gain control of execution flow

How to detect it

Inspect DHCP client logs and network captures for malformed Offer/ACK packets; look for unusual heap allocations or crashes in ipdhcpc process around DHCP transaction times.

• oversized DHCP option fields in Offer/ACK
• ipdhcpc process crashes following DHCP responses
• unexpected memory allocations during DHCP parsing

What your security team should do

• Prioritize patching golang/go dependencies to the specified commit across all builds
• Monitor EPSS trend and network DHCP traffic for anomalies given the 0.84 EPSS score
• Implement network segmentation to limit DHCP exposure on embedded/IoT segments