{"cve":"CVE-2020-17467","nvd":{"published":"2020-12-11T23:15:13.557","modified":"2026-06-17T02:58:58.723","status":"Modified","description":"An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check for '\\0' termination. Therefore, the deduced length of the hostname doesn't reflect the correct length of the actual data. This may lead to Information Disclosure in _fnet_llmnr_poll in fnet_llmnr.c during a response to a malicious request of the DNS class IN.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":9.1},"cwes":["CWE-125"],"references":["http://fnet.sourceforge.net/manual/fnet_history.html","https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01","https://www.kb.cert.org/vuls/id/815128","http://fnet.sourceforge.net/manual/fnet_history.html","https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01"],"products":["butok:fnet"],"source":"nvd","synced_at":"2026-10-19T21:12:09.559580076+00:00"},"epss":{"cve":"CVE-2020-17467","score":0.03076,"percentile":0.87665,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}