CVE-2020-1939 Null dereference in Apache NuttX (incubating)
A NULL pointer dereference in the optional ftpd component of NuttX RTOS allows attackers to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-1939?
CVE-2020-1939 is a critical vulnerability in Apache NuttX (incubating), published on 12 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.
Weakness: CWE-476
Which versions are affected by CVE-2020-1939?
It affects 1 product.
Products include Apache Nuttx.
How do I fix CVE-2020-1939?
No fix has been published for CVE-2020-1939 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-1939 being exploited?
There is no known exploitation of CVE-2020-1939 in the wild and no public exploit code.
Other vulnerabilities in Apache NuttX (incubating)
- CVE-2025-47868 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.
- CVE-2025-47869 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.
- CVE-2025-35003 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.
- CVE-2021-26461 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
- CVE-2020-17529 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header
Sources
Also known as GHSA-cxvf-qrfm-r86m.