vulnerability · 1592265600000

Ripple20 Vulnerabilities in Treck TCP/IP Stack

Nineteen vulnerabilities were disclosed in the Treck TCP/IP stack, affecting hundreds of millions of IoT and embedded devices globally.

What happened

JSOF researchers discovered 19 vulnerabilities (collectively 'Ripple20') in Treck's TCP/IP stack, widely used in embedded devices. Flaws included remote code execution, out-of-bounds write, and denial of service.

Technical mechanism

The vulnerabilities affected various components of the network stack (IPv4, UDP, DHCP, ICMP). For example, CVE-2020-11896 involved improper handling of IPv4 fragmentation and IP tunneling, leading to potential RCE.

Why it matters

Highlighted the systemic risks in the IoT supply chain, where foundational software libraries introduce widespread vulnerabilities across diverse industries.

Impact

Affected a vast array of devices from vendors like HP, Schneider Electric, and Baxter, exposing critical infrastructure, medical devices, and industrial systems to compromise.

Response

CISA issued an advisory (ICSA-20-168-01). Treck released patched software (version 6.0.1.67). Device manufacturers struggled to identify and patch affected products due to complex supply chains.

Defensive lessons

  • Deep visibility into IoT device software bills of materials (SBOM) is crucial.
  • Network segmentation is necessary to protect unpatchable embedded devices.
  • Supply chain security extends deep into foundational software libraries.

Evidence register

  1. CISA — Treck TCP/IP Stack (Update I) (verified)
  2. Forescout — Ripple20 Vulnerability (verified)