Ripple20: Multiple Vulnerabilities Identified in Treck TCP/IP Stack | Qualys

Summary: The JSOF research lab discovered Ripple20, a set of 19 vulnerabilities in the Treck TCP/IP stack used in embedded systems, affecting hundreds of devices or more. Four of the vulnerabilities - CVE-2020-11896, CVE-2020-11897, CVE-2020-11898, and CVE-2020-11901 - are critical with CVSS scores over 9 and enable remote code execution, and one sits in the DNS protocol and may be exploitable by a remote attacker even on devices not connected to the internet.
Why it matters: Patches are not yet available for all vendors, and one critical flaw in the DNS protocol can be reached on devices that are not connected to the internet at all - so the usual assumption that air-gapped or internal-only equipment is out of reach does not hold here.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-11896 CVE-2020-11897 CVE-2020-11898 CVE-2020-11899 CVE-2020-11900 CVE-2020-11901 CVE-2020-11904 CVE-2020-11905 CVE-2020-11906 CVE-2020-11907 CVE-2020-11909 CVE-2020-11910 CVE-2020-11911 CVE-2020-11912 CVE-2020-11914
Related: CVE-2020-11899: Treck TCP/IP stack Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026