Actively exploited · Published Jun 17, 2020 · Assigned by mitre
CVE-2020-11899
Medium 5.4 Exploited
In plain English
A medium-severity out-of-bounds read in IPv6 from Treck TCP/IP stack. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 18.4% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)18.4%top 2.8% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 17, 2022.
Official description
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Affected products (as reported)
Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://cwe.mitre.org/data/definitions/125.html x_refsource_MISC
- https://www.kb.cert.org/vuls/id/257161/ x_refsource_MISC
- https://www.treck.com x_refsource_MISC
- https://jsof-tech.com/vulnerability-disclosure-policy/ x_refsource_MISC
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html x_refsource_CONFIRM
- VU#257161 third-party-advisory, x_refsource_CERT-VN
- https://www.jsof-tech.com/ripple20/ x_refsource_MISC
- 20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020 vendor-advisory, x_refsource_CISCO
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200625-0006/ x_refsource_CONFIRM
- https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899 government-resource