The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A     vulnerability in versions prior to 1.8.7 allows an attacker to trigger a stack-based buffer overflow when     converting floating-point values to strings with high precision. By passing very large `decimalPlaces`     values to the affected String constructors or concat methods, the `dtostrf` function writes beyond fixed-     size stack buffers, causing memory corruption and denial of service. Under specific conditions, this could     enable arbitrary code execution on AVR-based Arduino boards. ### Patches - The Fix is included starting     from the `1.8.7` release available from the following link [ArduinoCore-avr     v1.8.7](https://github.com/arduino/ArduinoCore-avr) - The Fixing Commit is available at the following link     [1a6a417f89c8901dad646efce74ae9d3ddebfd59](https://github.com/arduino/ArduinoCore-     avr/pull/613/commits/1a6a417f89c8901dad646efce74ae9d3ddebfd59) ### References - [ASEC-26-001 ArduinoCore-     avr vXXXX Resolves Buffer Overflow Vulnerability](https://support.arduino.cc/hc/en-us/articles/XXXXX) ###     Credits - Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate (https://secmate.dev/)     (CVE-2025-69209)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-69209

medium Nessus Plugin ID 297679

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Feb 4, 2026, 2:23 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602041423
Version 1.2 Feb 4, 2026, 6:31 AM CVSS metrics ("CVSSv2 score" set to 9.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202602040631
Version 1.1 Feb 3, 2026, 10:27 PM New Plugin Feed: 202602032227