HOMEVULNERABILITIESCVE-2009-0687
HIGHPOC

CVE-2009-0687

CWE-399Published: August 11, 2009· Updated: Jun 16, 2026

7.8
CVSS v3.1

Official Description

The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.

NVD Source

Technical Analysis

CVE-2009-0687 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2009-0687. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.
User Interaction
Scope
Impact
ConfidentialityNone
IntegrityNone
AvailabilityC
AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected Vendors & Products

midnightbsd1 product(s)
midnightbsd
mirbsd1 product(s)
miros
netbsd1 product(s)
netbsd
openbsd1 product(s)
openbsd
Source: NVD CPE · 7 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch
PATCHhttp://www.openbsd.org/errata43.html#013_pf
PATCHhttp://www.openbsd.org/errata44.html#013_pf
PATCHhttp://www.openbsd.org/errata45.html#002_pf
PATCHhttp://www.vupen.com/english/advisories/2009/1015
PATCHftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch
PATCHhttp://www.openbsd.org/errata43.html#013_pf
PATCHhttp://www.openbsd.org/errata44.html#013_pf
PATCHhttp://www.openbsd.org/errata45.html#002_pf
PATCHhttp://www.vupen.com/english/advisories/2009/1015
ADVISORYhttp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc
ADVISORYhttp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc

All References (24)

→
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patchPatch · Vendor Advisory
→
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.ascVendor Advisory
→
http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt
→
http://www.openbsd.org/errata43.html#013_pfPatch · Vendor Advisory
→
http://www.openbsd.org/errata44.html#013_pfPatch · Vendor Advisory
→
http://www.openbsd.org/errata45.html#002_pfPatch · Vendor Advisory
→
http://www.osvdb.org/53608
→
http://www.securityfocus.com/archive/1/502634
→
http://www.vupen.com/english/advisories/2009/1015Patch · Vendor Advisory
→
https://exchange.xforce.ibmcloud.com/vulnerabilities/49837
→
https://www.exploit-db.com/exploits/8406
→
https://www.exploit-db.com/exploits/8581
→
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patchPatch · Vendor Advisory
→
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.ascVendor Advisory
→
http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt

Quick Facts

CVE IDCVE-2009-0687
CVSS Score7.8 / 10
SeverityHIGH
WeaknessCWE-399
CISA KEVNo
ExploitPOC
Affected4 vendor(s)
PublishedAug 11, 2009

Related CVEs (CWE-399)

CVE-2011-3488
10.0
CVE-2010-0477
10.0
CVE-2007-5332
10.0
CVE-2008-3641
10.0
CVE-2009-3103
10.0
CVE-2010-0476
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2009-0687 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2009-0687·NVD