Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-11910 (GCVE-0-2020-11910)
Vulnerability from cvelistv5
Published
2020-06-17 10:52
Modified
2025-09-30 15:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.800Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.treck.com"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"name": "VU#257161",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2020-11910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-30T15:49:31.482628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-30T15:49:44.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-22T00:23:04.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.treck.com"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"name": "VU#257161",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11910",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.kb.cert.org/vuls/id/257161/",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"name": "https://www.treck.com",
"refsource": "MISC",
"url": "https://www.treck.com"
},
{
"name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
"refsource": "MISC",
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"name": "VU#257161",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"name": "https://www.jsof-tech.com/ripple20/",
"refsource": "MISC",
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
"refsource": "CONFIRM",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
"refsource": "MISC",
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-11910",
"datePublished": "2020-06-17T10:52:48.000Z",
"dateReserved": "2020-04-19T00:00:00.000Z",
"dateUpdated": "2025-09-30T15:49:44.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-11910\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-06-17T11:15:11.023\",\"lastModified\":\"2025-09-30T16:15:50.690\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.\"},{\"lang\":\"es\",\"value\":\"La pila de Treck TCP/IP versiones anteriores a 6.0.1.66, presenta una Lectura Fuera de L\u00edmites de ICMPv4\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:treck:tcp\\\\/ip:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.1.66\",\"matchCriteriaId\":\"51F9D0DF-D9F0-4183-AC07-C799EFFE36C8\"}]}]}],\"references\":[{\"url\":\"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://jsof-tech.com/vulnerability-disclosure-policy/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200625-0006/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.jsof-tech.com/ripple20/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/257161\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.kb.cert.org/vuls/id/257161/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mitigation\",\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.treck.com\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\",\"Vendor Advisory\"]},{\"url\":\"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://jsof-tech.com/vulnerability-disclosure-policy/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200625-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.jsof-tech.com/ripple20/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/257161\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.kb.cert.org/vuls/id/257161/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.treck.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.kb.cert.org/vuls/id/257161/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.treck.com\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://jsof-tech.com/vulnerability-disclosure-policy/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/257161\", \"name\": \"VU#257161\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\", \"x_transferred\"]}, {\"url\": \"https://www.jsof-tech.com/ripple20/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\", \"name\": \"20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\", \"x_transferred\"]}, {\"url\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200625-0006/\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T11:42:00.800Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2020-11910\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-30T15:49:31.482628Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-30T14:47:22.935Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://www.kb.cert.org/vuls/id/257161/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.treck.com\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://jsof-tech.com/vulnerability-disclosure-policy/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/257161\", \"name\": \"VU#257161\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT-VN\"]}, {\"url\": \"https://www.jsof-tech.com/ripple20/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\", \"name\": \"20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020\", \"tags\": [\"vendor-advisory\", \"x_refsource_CISCO\"]}, {\"url\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200625-0006/\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2020-07-22T00:23:04.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://www.kb.cert.org/vuls/id/257161/\", \"name\": \"https://www.kb.cert.org/vuls/id/257161/\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.treck.com\", \"name\": \"https://www.treck.com\", \"refsource\": \"MISC\"}, {\"url\": \"https://jsof-tech.com/vulnerability-disclosure-policy/\", \"name\": \"https://jsof-tech.com/vulnerability-disclosure-policy/\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.kb.cert.org/vuls/id/257161\", \"name\": \"VU#257161\", \"refsource\": \"CERT-VN\"}, {\"url\": \"https://www.jsof-tech.com/ripple20/\", \"name\": \"https://www.jsof-tech.com/ripple20/\", \"refsource\": \"MISC\"}, {\"url\": \"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\", \"name\": \"20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020\", \"refsource\": \"CISCO\"}, {\"url\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\", \"name\": \"http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200625-0006/\", \"name\": \"https://security.netapp.com/advisory/ntap-20200625-0006/\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\", \"name\": \"https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2020-11910\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"cve@mitre.org\"}}}}",
"cveMetadata": "{\"cveId\": \"CVE-2020-11910\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-30T15:49:44.342Z\", \"dateReserved\": \"2020-04-19T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2020-06-17T10:52:48.000Z\", \"assignerShortName\": \"mitre\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
cisco-sa-treck-ip-stack-jybq5gyc
Vulnerability from csaf_cisco
Published
2020-06-17 20:00
Modified
2020-08-21 16:40
Summary
Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020
Notes
Summary
A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"]
Affected Products
Cisco investigated its product line to determine which products may be affected by these vulnerabilities.
The Vulnerable Products ["#vp"] section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool ["https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Any product or service not listed in the Vulnerable Products ["#vp"] section of this advisory is to be considered not vulnerable.
Vulnerable Products
The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details. Unless otherwise documented, all software releases prior to the first fixed release are to be considered affected by these vulnerabilities.
Product Cisco Bug ID Fixed Release Availability Routing and Switching - Enterprise and Service Provider Cisco ASR 5000 CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020) Cisco ASR 5500 CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020)
21.8.x (14 Sep 2020)
21.9.x (8 Sep 2020)
21.10.x (2 Sep 2020)
21.11.15 (29 Jul 2020)
21.12.x (4 Sep 2020)
21.13.x (31 Aug 2020)
21.14.22 (30 Jul 2020)
21.15.45 (22 Jul 2020)
21.16.x (25 Aug 2020)
21.17.10 (20 Aug 2020)
21.18.8 (24 Aug 2020)
21.19.5 (19 Aug 2020)
21.20.2 (24 Jul 2020) Cisco Virtual Packet Core CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020)
21.8.x (14 Sep 2020)
21.9.x (8 Sep 2020)
21.10.x (2 Sep 2020)
21.11.15 (29 Jul 2020)
21.12.x (4 Sep 2020)
21.13.x (31 Aug 2020)
21.14.22 (30 Jul 2020)
21.15.45 (22 Jul 2020)
21.16.x (25 Aug 2020)
21.17.10 (20 Aug 2020)
21.18.8 (24 Aug 2020)
21.19.5 (19 Aug 2020)
21.20.2 (24 Jul 2020)
Note: Exposure to the vulnerabilities may be configuration dependent. See the Cisco bug(s) for the most complete product-specific information.
Cisco StarOS Software
In the following table, the left column lists the Cisco StarOS Software features that are vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. If a device is configured for one of these features, it is vulnerable.
Cisco StarOS Software Feature Vulnerable Configuration URL-based Re-addressing
flow action url-readdress server [...]
SIP ALG NAT Inspection
firewall nat-alg sip [...]
H323 ALG NAT Inspection
firewall nat-alg h323 [...]
Inline TCP Optimization (CUSP)
tcp-acceleration [...]
If a Cisco StarOS Software deployment uses a vulnerable configuration, as described above, it may be affected by the following vulnerabilities:
CVE-2020-11896: Malformed IPv4 Tunneled Packets Processing Remote Code Execution Vulnerability
CVE-2020-11898: Malformed IPv4 Packets Processing Out-of-Bounds Read Vulnerability
CVE-2020-11899: Improper Input Validation in IPv6 Out-of-Bounds Read Vulnerability
CVE-2020-11900: IPv4 Tunneling Component Double-Free Vulnerability
CVE-2020-11907: Improper Packet Length Checks Integer Underflow Vulnerability
CVE-2020-11909: Improper Input Validation in IPv4 Component
CVE-2020-11912: Improper Input Validation in TCP Component
CVE-2020-11913: Improper Input Validation in IPv6 Component
Cisco has confirmed that Cisco StarOS Software is not affected by the following vulnerabilities:
CVE-2020-11897: Malformed IPv6 Packets Processing Out-of-Bounds Read and Write Vulnerability
CVE-2020-11901: DNS Response Processing Remote Code Execution Vulnerability
CVE-2020-11902: Out-of-Bounds Read When Processing IPv6 over IPv4 Packets
CVE-2020-11903: Out-of-Bounds Read Processing DHCP Response
CVE-2020-11904: Integer Overflow in Memory Allocation
CVE-2020-11905: DHCPv6 Out-of-Bounds Read Vulnerability
CVE-2020-11906: Ethernet Link Layer Component Integer Underflow Vulnerability
CVE-2020-11908: Improper Null Termination in DHCP Component
CVE-2020-11910: Improper Input Validation in ICMPv4 Component
CVE-2020-11911: Improper Access Control in ICMPv4 Component
CVE-2020-11914: Improper Input Validation in ARP Component
Products Confirmed Not Vulnerable
Only products and services listed in the Vulnerable Products ["#vulnerable"] section of this advisory are known to be affected by these vulnerabilities.
Workarounds
There are no workarounds that address these vulnerabilities.
A set of network based mitigations has been documented by the CERT Coordination Center and is available at the following address:
https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md ["https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md"]
Fixed Software
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products ["#vp"] section of this advisory.
When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerabilities that are described in this advisory.
Source
These vulnerabilities were discovered and reported to CERT/CC by JSOF.
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.
{
"document": {
"acknowledgments": [
{
"summary": "These vulnerabilities were discovered and reported to CERT/CC by JSOF."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability.\r\n\r\nThis advisory will be updated as additional information becomes available.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\"]",
"title": "Summary"
},
{
"category": "general",
"text": "Cisco investigated its product line to determine which products may be affected by these vulnerabilities.\r\n\r\nThe Vulnerable Products [\"#vp\"] section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product or service not listed in the Vulnerable Products [\"#vp\"] section of this advisory is to be considered not vulnerable.",
"title": "Affected Products"
},
{
"category": "general",
"text": "The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details. Unless otherwise documented, all software releases prior to the first fixed release are to be considered affected by these vulnerabilities.\r\n Product Cisco Bug ID Fixed Release Availability Routing and Switching - Enterprise and Service Provider Cisco ASR 5000 CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020) Cisco ASR 5500 CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020)\r\n21.8.x (14 Sep 2020)\r\n21.9.x (8 Sep 2020)\r\n21.10.x (2 Sep 2020)\r\n21.11.15 (29 Jul 2020)\r\n21.12.x (4 Sep 2020)\r\n21.13.x (31 Aug 2020)\r\n21.14.22 (30 Jul 2020)\r\n21.15.45 (22 Jul 2020)\r\n21.16.x (25 Aug 2020)\r\n21.17.10 (20 Aug 2020)\r\n21.18.8 (24 Aug 2020)\r\n21.19.5 (19 Aug 2020)\r\n21.20.2 (24 Jul 2020) Cisco Virtual Packet Core CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020)\r\n21.8.x (14 Sep 2020)\r\n21.9.x (8 Sep 2020)\r\n21.10.x (2 Sep 2020)\r\n21.11.15 (29 Jul 2020)\r\n21.12.x (4 Sep 2020)\r\n21.13.x (31 Aug 2020)\r\n21.14.22 (30 Jul 2020)\r\n21.15.45 (22 Jul 2020)\r\n21.16.x (25 Aug 2020)\r\n21.17.10 (20 Aug 2020)\r\n21.18.8 (24 Aug 2020)\r\n21.19.5 (19 Aug 2020)\r\n21.20.2 (24 Jul 2020)\r\nNote: Exposure to the vulnerabilities may be configuration dependent. See the Cisco bug(s) for the most complete product-specific information.\r\n Cisco StarOS Software\r\nIn the following table, the left column lists the Cisco StarOS Software features that are vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. If a device is configured for one of these features, it is vulnerable.\r\n Cisco StarOS Software Feature Vulnerable Configuration URL-based Re-addressing\r\nflow action url-readdress server [...]\r\n SIP ALG NAT Inspection\r\nfirewall nat-alg sip [...]\r\n H323 ALG NAT Inspection\r\nfirewall nat-alg h323 [...]\r\n Inline TCP Optimization (CUSP)\r\ntcp-acceleration [...]\r\n\r\nIf a Cisco StarOS Software deployment uses a vulnerable configuration, as described above, it may be affected by the following vulnerabilities:\r\n\r\nCVE-2020-11896: Malformed IPv4 Tunneled Packets Processing Remote Code Execution Vulnerability\r\nCVE-2020-11898: Malformed IPv4 Packets Processing Out-of-Bounds Read Vulnerability\r\nCVE-2020-11899: Improper Input Validation in IPv6 Out-of-Bounds Read Vulnerability\r\nCVE-2020-11900: IPv4 Tunneling Component Double-Free Vulnerability\r\nCVE-2020-11907: Improper Packet Length Checks Integer Underflow Vulnerability\r\nCVE-2020-11909: Improper Input Validation in IPv4 Component\r\nCVE-2020-11912: Improper Input Validation in TCP Component\r\nCVE-2020-11913: Improper Input Validation in IPv6 Component\r\n\r\nCisco has confirmed that Cisco StarOS Software is not affected by the following vulnerabilities:\r\n\r\nCVE-2020-11897: Malformed IPv6 Packets Processing Out-of-Bounds Read and Write Vulnerability\r\nCVE-2020-11901: DNS Response Processing Remote Code Execution Vulnerability\r\nCVE-2020-11902: Out-of-Bounds Read When Processing IPv6 over IPv4 Packets\r\nCVE-2020-11903: Out-of-Bounds Read Processing DHCP Response\r\nCVE-2020-11904: Integer Overflow in Memory Allocation\r\nCVE-2020-11905: DHCPv6 Out-of-Bounds Read Vulnerability\r\nCVE-2020-11906: Ethernet Link Layer Component Integer Underflow Vulnerability\r\nCVE-2020-11908: Improper Null Termination in DHCP Component\r\nCVE-2020-11910: Improper Input Validation in ICMPv4 Component\r\nCVE-2020-11911: Improper Access Control in ICMPv4 Component\r\nCVE-2020-11914: Improper Input Validation in ARP Component",
"title": "Vulnerable Products"
},
{
"category": "general",
"text": "Only products and services listed in the Vulnerable Products [\"#vulnerable\"] section of this advisory are known to be affected by these vulnerabilities.",
"title": "Products Confirmed Not Vulnerable"
},
{
"category": "general",
"text": "There are no workarounds that address these vulnerabilities.\r\n\r\nA set of network based mitigations has been documented by the CERT Coordination Center and is available at the following address:\r\n\r\nhttps://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md [\"https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md\"]",
"title": "Workarounds"
},
{
"category": "general",
"text": "For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.",
"title": "Fixed Software"
},
{
"category": "general",
"text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
"title": "Vulnerability Policy"
},
{
"category": "general",
"text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerabilities that are described in this advisory.",
"title": "Exploitation and Public Announcements"
},
{
"category": "general",
"text": "These vulnerabilities were discovered and reported to CERT/CC by JSOF.",
"title": "Source"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
"issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
"name": "Cisco",
"namespace": "https://wwww.cisco.com"
},
"references": [
{
"category": "self",
"summary": "Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "Cisco Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "Cisco Bug Search Tool",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md",
"url": "https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md"
},
{
"category": "external",
"summary": "considering software upgrades",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
},
{
"category": "external",
"summary": "Cisco Security Advisories page",
"url": "https://www.cisco.com/go/psirt"
},
{
"category": "external",
"summary": "Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
}
],
"title": "Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"tracking": {
"current_release_date": "2020-08-21T16:40:13+00:00",
"generator": {
"date": "2022-10-22T03:05:23+00:00",
"engine": {
"name": "TVCE"
}
},
"id": "cisco-sa-treck-ip-stack-JyBQ5GyC",
"initial_release_date": "2020-06-17T20:00:00+00:00",
"revision_history": [
{
"date": "2020-06-17T20:08:26+00:00",
"number": "1.0.0",
"summary": "Initial public release."
},
{
"date": "2020-06-22T21:59:35+00:00",
"number": "1.1.0",
"summary": "Updated the lists of products under investigation and vulnerable products."
},
{
"date": "2020-07-07T19:09:00+00:00",
"number": "1.2.0",
"summary": "Updated the list of vulnerable products: changed the product naming to refer to the affected platform rather than to the function (for example, GGSN, IPSG) for StarOS-based products. No products remain under investigation."
},
{
"date": "2020-07-10T17:10:26+00:00",
"number": "1.3.0",
"summary": "Added the fixed release availability information for vulnerable products. Added links to Snort rules."
},
{
"date": "2020-07-17T15:59:05+00:00",
"number": "1.4.0",
"summary": "Updated the vulnerable products with fix availability information. Added a reference to mitigations documented by CERT/CC."
},
{
"date": "2020-07-22T18:35:23+00:00",
"number": "1.5.0",
"summary": "Updated fixed release availability information. Clarified that exposure to the vulnerabilities may be configuration dependent."
},
{
"date": "2020-07-24T17:04:38+00:00",
"number": "1.6.0",
"summary": "Updated fixed release availability information. Documented vulnerable StarOS configurations. Specified which vulnerabilities affect StarOS."
},
{
"date": "2020-07-29T16:09:58+00:00",
"number": "1.7.0",
"summary": "Updated fixed release availability information."
},
{
"date": "2020-08-21T16:40:13+00:00",
"number": "1.8.0",
"summary": "Updated fixed release availability information. Added links to additional Snort rules."
}
],
"status": "interim",
"version": "1.8.0"
}
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Malformed IPv4 Tunnelled Packets Processing Remote Code Execution Vulnerability"
},
{
"cve": "CVE-2020-11897",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Malformed IPv6 Packets Processing Out Of Bounds Read Write Vulnerability"
},
{
"cve": "CVE-2020-11901",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "DNS Response Processing Remote Code Execution Vulnerability"
},
{
"cve": "CVE-2020-11900",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Double free in IPv4 tunnelling compnent"
},
{
"cve": "CVE-2020-11898",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-16T17:21:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11898"
},
{
"cve": "CVE-2020-11904",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T16:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11904"
},
{
"cve": "CVE-2020-11903",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-16T17:22:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11903"
},
{
"cve": "CVE-2020-11899",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in IPv6 handling Our Of Bounds Read Vulnerability"
},
{
"cve": "CVE-2020-11910",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper input validation in ICMPv4 component"
},
{
"cve": "CVE-2020-11902",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Out of Bounds Read when processing IPv6OverIPv4 packets"
},
{
"cve": "CVE-2020-11914",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in ARP component"
},
{
"cve": "CVE-2020-11906",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Integer Underflow in Ethernet Link Layer Component"
},
{
"cve": "CVE-2020-11911",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Access Control in ICMPv4 component"
},
{
"cve": "CVE-2020-11907",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Integer Underflow in TCP processing"
},
{
"cve": "CVE-2020-11912",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in TCP component"
},
{
"cve": "CVE-2020-11908",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Null Termination in DHCP component"
},
{
"cve": "CVE-2020-11913",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in IPv6 component"
},
{
"cve": "CVE-2020-11909",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper input validation in IPv4 component"
},
{
"cve": "CVE-2020-11905",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Out Of Bounds read in DHCPv6 component"
}
]
}
cisco-sa-treck-ip-stack-JyBQ5GyC
Vulnerability from csaf_cisco
Published
2020-06-17 20:00
Modified
2020-08-21 16:40
Summary
Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020
Notes
Summary
A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"]
Affected Products
Cisco investigated its product line to determine which products may be affected by these vulnerabilities.
The Vulnerable Products ["#vp"] section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool ["https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Any product or service not listed in the Vulnerable Products ["#vp"] section of this advisory is to be considered not vulnerable.
Vulnerable Products
The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details. Unless otherwise documented, all software releases prior to the first fixed release are to be considered affected by these vulnerabilities.
Product Cisco Bug ID Fixed Release Availability Routing and Switching - Enterprise and Service Provider Cisco ASR 5000 CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020) Cisco ASR 5500 CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020)
21.8.x (14 Sep 2020)
21.9.x (8 Sep 2020)
21.10.x (2 Sep 2020)
21.11.15 (29 Jul 2020)
21.12.x (4 Sep 2020)
21.13.x (31 Aug 2020)
21.14.22 (30 Jul 2020)
21.15.45 (22 Jul 2020)
21.16.x (25 Aug 2020)
21.17.10 (20 Aug 2020)
21.18.8 (24 Aug 2020)
21.19.5 (19 Aug 2020)
21.20.2 (24 Jul 2020) Cisco Virtual Packet Core CSCvu68945 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"] 21.5.27 (30 Jul 2020)
21.8.x (14 Sep 2020)
21.9.x (8 Sep 2020)
21.10.x (2 Sep 2020)
21.11.15 (29 Jul 2020)
21.12.x (4 Sep 2020)
21.13.x (31 Aug 2020)
21.14.22 (30 Jul 2020)
21.15.45 (22 Jul 2020)
21.16.x (25 Aug 2020)
21.17.10 (20 Aug 2020)
21.18.8 (24 Aug 2020)
21.19.5 (19 Aug 2020)
21.20.2 (24 Jul 2020)
Note: Exposure to the vulnerabilities may be configuration dependent. See the Cisco bug(s) for the most complete product-specific information.
Cisco StarOS Software
In the following table, the left column lists the Cisco StarOS Software features that are vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. If a device is configured for one of these features, it is vulnerable.
Cisco StarOS Software Feature Vulnerable Configuration URL-based Re-addressing
flow action url-readdress server [...]
SIP ALG NAT Inspection
firewall nat-alg sip [...]
H323 ALG NAT Inspection
firewall nat-alg h323 [...]
Inline TCP Optimization (CUSP)
tcp-acceleration [...]
If a Cisco StarOS Software deployment uses a vulnerable configuration, as described above, it may be affected by the following vulnerabilities:
CVE-2020-11896: Malformed IPv4 Tunneled Packets Processing Remote Code Execution Vulnerability
CVE-2020-11898: Malformed IPv4 Packets Processing Out-of-Bounds Read Vulnerability
CVE-2020-11899: Improper Input Validation in IPv6 Out-of-Bounds Read Vulnerability
CVE-2020-11900: IPv4 Tunneling Component Double-Free Vulnerability
CVE-2020-11907: Improper Packet Length Checks Integer Underflow Vulnerability
CVE-2020-11909: Improper Input Validation in IPv4 Component
CVE-2020-11912: Improper Input Validation in TCP Component
CVE-2020-11913: Improper Input Validation in IPv6 Component
Cisco has confirmed that Cisco StarOS Software is not affected by the following vulnerabilities:
CVE-2020-11897: Malformed IPv6 Packets Processing Out-of-Bounds Read and Write Vulnerability
CVE-2020-11901: DNS Response Processing Remote Code Execution Vulnerability
CVE-2020-11902: Out-of-Bounds Read When Processing IPv6 over IPv4 Packets
CVE-2020-11903: Out-of-Bounds Read Processing DHCP Response
CVE-2020-11904: Integer Overflow in Memory Allocation
CVE-2020-11905: DHCPv6 Out-of-Bounds Read Vulnerability
CVE-2020-11906: Ethernet Link Layer Component Integer Underflow Vulnerability
CVE-2020-11908: Improper Null Termination in DHCP Component
CVE-2020-11910: Improper Input Validation in ICMPv4 Component
CVE-2020-11911: Improper Access Control in ICMPv4 Component
CVE-2020-11914: Improper Input Validation in ARP Component
Products Confirmed Not Vulnerable
Only products and services listed in the Vulnerable Products ["#vulnerable"] section of this advisory are known to be affected by these vulnerabilities.
Workarounds
There are no workarounds that address these vulnerabilities.
A set of network based mitigations has been documented by the CERT Coordination Center and is available at the following address:
https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md ["https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md"]
Fixed Software
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products ["#vp"] section of this advisory.
When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerabilities that are described in this advisory.
Source
These vulnerabilities were discovered and reported to CERT/CC by JSOF.
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.
{
"document": {
"acknowledgments": [
{
"summary": "These vulnerabilities were discovered and reported to CERT/CC by JSOF."
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"notes": [
{
"category": "summary",
"text": "A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability.\r\n\r\nThis advisory will be updated as additional information becomes available.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC\"]",
"title": "Summary"
},
{
"category": "general",
"text": "Cisco investigated its product line to determine which products may be affected by these vulnerabilities.\r\n\r\nThe Vulnerable Products [\"#vp\"] section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool [\"https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID\"] and contain additional platform-specific information, including workarounds (if available) and fixed software releases.\r\n\r\nAny product or service not listed in the Vulnerable Products [\"#vp\"] section of this advisory is to be considered not vulnerable.",
"title": "Affected Products"
},
{
"category": "general",
"text": "The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details. Unless otherwise documented, all software releases prior to the first fixed release are to be considered affected by these vulnerabilities.\r\n Product Cisco Bug ID Fixed Release Availability Routing and Switching - Enterprise and Service Provider Cisco ASR 5000 CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020) Cisco ASR 5500 CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020)\r\n21.8.x (14 Sep 2020)\r\n21.9.x (8 Sep 2020)\r\n21.10.x (2 Sep 2020)\r\n21.11.15 (29 Jul 2020)\r\n21.12.x (4 Sep 2020)\r\n21.13.x (31 Aug 2020)\r\n21.14.22 (30 Jul 2020)\r\n21.15.45 (22 Jul 2020)\r\n21.16.x (25 Aug 2020)\r\n21.17.10 (20 Aug 2020)\r\n21.18.8 (24 Aug 2020)\r\n21.19.5 (19 Aug 2020)\r\n21.20.2 (24 Jul 2020) Cisco Virtual Packet Core CSCvu68945 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945\"] 21.5.27 (30 Jul 2020)\r\n21.8.x (14 Sep 2020)\r\n21.9.x (8 Sep 2020)\r\n21.10.x (2 Sep 2020)\r\n21.11.15 (29 Jul 2020)\r\n21.12.x (4 Sep 2020)\r\n21.13.x (31 Aug 2020)\r\n21.14.22 (30 Jul 2020)\r\n21.15.45 (22 Jul 2020)\r\n21.16.x (25 Aug 2020)\r\n21.17.10 (20 Aug 2020)\r\n21.18.8 (24 Aug 2020)\r\n21.19.5 (19 Aug 2020)\r\n21.20.2 (24 Jul 2020)\r\nNote: Exposure to the vulnerabilities may be configuration dependent. See the Cisco bug(s) for the most complete product-specific information.\r\n Cisco StarOS Software\r\nIn the following table, the left column lists the Cisco StarOS Software features that are vulnerable. The right column indicates the basic configuration for the feature from the show running-config CLI command. If a device is configured for one of these features, it is vulnerable.\r\n Cisco StarOS Software Feature Vulnerable Configuration URL-based Re-addressing\r\nflow action url-readdress server [...]\r\n SIP ALG NAT Inspection\r\nfirewall nat-alg sip [...]\r\n H323 ALG NAT Inspection\r\nfirewall nat-alg h323 [...]\r\n Inline TCP Optimization (CUSP)\r\ntcp-acceleration [...]\r\n\r\nIf a Cisco StarOS Software deployment uses a vulnerable configuration, as described above, it may be affected by the following vulnerabilities:\r\n\r\nCVE-2020-11896: Malformed IPv4 Tunneled Packets Processing Remote Code Execution Vulnerability\r\nCVE-2020-11898: Malformed IPv4 Packets Processing Out-of-Bounds Read Vulnerability\r\nCVE-2020-11899: Improper Input Validation in IPv6 Out-of-Bounds Read Vulnerability\r\nCVE-2020-11900: IPv4 Tunneling Component Double-Free Vulnerability\r\nCVE-2020-11907: Improper Packet Length Checks Integer Underflow Vulnerability\r\nCVE-2020-11909: Improper Input Validation in IPv4 Component\r\nCVE-2020-11912: Improper Input Validation in TCP Component\r\nCVE-2020-11913: Improper Input Validation in IPv6 Component\r\n\r\nCisco has confirmed that Cisco StarOS Software is not affected by the following vulnerabilities:\r\n\r\nCVE-2020-11897: Malformed IPv6 Packets Processing Out-of-Bounds Read and Write Vulnerability\r\nCVE-2020-11901: DNS Response Processing Remote Code Execution Vulnerability\r\nCVE-2020-11902: Out-of-Bounds Read When Processing IPv6 over IPv4 Packets\r\nCVE-2020-11903: Out-of-Bounds Read Processing DHCP Response\r\nCVE-2020-11904: Integer Overflow in Memory Allocation\r\nCVE-2020-11905: DHCPv6 Out-of-Bounds Read Vulnerability\r\nCVE-2020-11906: Ethernet Link Layer Component Integer Underflow Vulnerability\r\nCVE-2020-11908: Improper Null Termination in DHCP Component\r\nCVE-2020-11910: Improper Input Validation in ICMPv4 Component\r\nCVE-2020-11911: Improper Access Control in ICMPv4 Component\r\nCVE-2020-11914: Improper Input Validation in ARP Component",
"title": "Vulnerable Products"
},
{
"category": "general",
"text": "Only products and services listed in the Vulnerable Products [\"#vulnerable\"] section of this advisory are known to be affected by these vulnerabilities.",
"title": "Products Confirmed Not Vulnerable"
},
{
"category": "general",
"text": "There are no workarounds that address these vulnerabilities.\r\n\r\nA set of network based mitigations has been documented by the CERT Coordination Center and is available at the following address:\r\n\r\nhttps://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md [\"https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md\"]",
"title": "Workarounds"
},
{
"category": "general",
"text": "For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.",
"title": "Fixed Software"
},
{
"category": "general",
"text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
"title": "Vulnerability Policy"
},
{
"category": "general",
"text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerabilities that are described in this advisory.",
"title": "Exploitation and Public Announcements"
},
{
"category": "general",
"text": "These vulnerabilities were discovered and reported to CERT/CC by JSOF.",
"title": "Source"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
"issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
"name": "Cisco",
"namespace": "https://wwww.cisco.com"
},
"references": [
{
"category": "self",
"summary": "Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "Cisco Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
},
{
"category": "external",
"summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "Cisco Bug Search Tool",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/BUGID"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "CSCvu68945",
"url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu68945"
},
{
"category": "external",
"summary": "https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md",
"url": "https://github.com/CERTCC/PoC-Exploits/blob/master/vu-257161/recommendations.md"
},
{
"category": "external",
"summary": "considering software upgrades",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
},
{
"category": "external",
"summary": "Cisco Security Advisories page",
"url": "https://www.cisco.com/go/psirt"
},
{
"category": "external",
"summary": "Security Vulnerability Policy",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
}
],
"title": "Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"tracking": {
"current_release_date": "2020-08-21T16:40:13+00:00",
"generator": {
"date": "2022-10-22T03:05:23+00:00",
"engine": {
"name": "TVCE"
}
},
"id": "cisco-sa-treck-ip-stack-JyBQ5GyC",
"initial_release_date": "2020-06-17T20:00:00+00:00",
"revision_history": [
{
"date": "2020-06-17T20:08:26+00:00",
"number": "1.0.0",
"summary": "Initial public release."
},
{
"date": "2020-06-22T21:59:35+00:00",
"number": "1.1.0",
"summary": "Updated the lists of products under investigation and vulnerable products."
},
{
"date": "2020-07-07T19:09:00+00:00",
"number": "1.2.0",
"summary": "Updated the list of vulnerable products: changed the product naming to refer to the affected platform rather than to the function (for example, GGSN, IPSG) for StarOS-based products. No products remain under investigation."
},
{
"date": "2020-07-10T17:10:26+00:00",
"number": "1.3.0",
"summary": "Added the fixed release availability information for vulnerable products. Added links to Snort rules."
},
{
"date": "2020-07-17T15:59:05+00:00",
"number": "1.4.0",
"summary": "Updated the vulnerable products with fix availability information. Added a reference to mitigations documented by CERT/CC."
},
{
"date": "2020-07-22T18:35:23+00:00",
"number": "1.5.0",
"summary": "Updated fixed release availability information. Clarified that exposure to the vulnerabilities may be configuration dependent."
},
{
"date": "2020-07-24T17:04:38+00:00",
"number": "1.6.0",
"summary": "Updated fixed release availability information. Documented vulnerable StarOS configurations. Specified which vulnerabilities affect StarOS."
},
{
"date": "2020-07-29T16:09:58+00:00",
"number": "1.7.0",
"summary": "Updated fixed release availability information."
},
{
"date": "2020-08-21T16:40:13+00:00",
"number": "1.8.0",
"summary": "Updated fixed release availability information. Added links to additional Snort rules."
}
],
"status": "interim",
"version": "1.8.0"
}
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Malformed IPv4 Tunnelled Packets Processing Remote Code Execution Vulnerability"
},
{
"cve": "CVE-2020-11897",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Malformed IPv6 Packets Processing Out Of Bounds Read Write Vulnerability"
},
{
"cve": "CVE-2020-11901",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "DNS Response Processing Remote Code Execution Vulnerability"
},
{
"cve": "CVE-2020-11900",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Double free in IPv4 tunnelling compnent"
},
{
"cve": "CVE-2020-11898",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-16T17:21:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11898"
},
{
"cve": "CVE-2020-11904",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T16:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11904"
},
{
"cve": "CVE-2020-11903",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-16T17:22:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "vuln-CVE-2020-11903"
},
{
"cve": "CVE-2020-11899",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in IPv6 handling Our Of Bounds Read Vulnerability"
},
{
"cve": "CVE-2020-11910",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper input validation in ICMPv4 component"
},
{
"cve": "CVE-2020-11902",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Out of Bounds Read when processing IPv6OverIPv4 packets"
},
{
"cve": "CVE-2020-11914",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in ARP component"
},
{
"cve": "CVE-2020-11906",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Integer Underflow in Ethernet Link Layer Component"
},
{
"cve": "CVE-2020-11911",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Access Control in ICMPv4 component"
},
{
"cve": "CVE-2020-11907",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Integer Underflow in TCP processing"
},
{
"cve": "CVE-2020-11912",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in TCP component"
},
{
"cve": "CVE-2020-11908",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Null Termination in DHCP component"
},
{
"cve": "CVE-2020-11913",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper Input Validation in IPv6 component"
},
{
"cve": "CVE-2020-11909",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Improper input validation in IPv4 component"
},
{
"cve": "CVE-2020-11905",
"notes": [
{
"category": "general",
"text": "No additional information for this vulneraiblity is currently avaialbe.",
"title": "No Notes"
}
],
"release_date": "2020-06-17T20:00:00+00:00",
"remediations": [
{
"category": "none_available",
"details": "No remediation is available at this time."
}
],
"title": "Out Of Bounds read in DHCPv6 component"
}
]
}
fkie_cve-2020-11910
Vulnerability from fkie_nvd
Published
2020-06-17 11:15
Modified
2025-09-30 16:15
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt | ||
| cve@mitre.org | https://jsof-tech.com/vulnerability-disclosure-policy/ | Third Party Advisory | |
| cve@mitre.org | https://security.netapp.com/advisory/ntap-20200625-0006/ | ||
| cve@mitre.org | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC | Third Party Advisory | |
| cve@mitre.org | https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities | ||
| cve@mitre.org | https://www.jsof-tech.com/ripple20/ | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.kb.cert.org/vuls/id/257161 | ||
| cve@mitre.org | https://www.kb.cert.org/vuls/id/257161/ | Mitigation, Third Party Advisory, US Government Resource | |
| cve@mitre.org | https://www.treck.com | Product, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://jsof-tech.com/vulnerability-disclosure-policy/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20200625-0006/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.jsof-tech.com/ripple20/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.kb.cert.org/vuls/id/257161 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.kb.cert.org/vuls/id/257161/ | Mitigation, Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.treck.com | Product, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:treck:tcp\\/ip:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51F9D0DF-D9F0-4183-AC07-C799EFFE36C8",
"versionEndExcluding": "6.0.1.66",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
},
{
"lang": "es",
"value": "La pila de Treck TCP/IP versiones anteriores a 6.0.1.66, presenta una Lectura Fuera de L\u00edmites de ICMPv4"
}
],
"id": "CVE-2020-11910",
"lastModified": "2025-09-30T16:15:50.690",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2020-06-17T11:15:11.023",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"source": "cve@mitre.org",
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"source": "cve@mitre.org",
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"source": "cve@mitre.org",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"source": "cve@mitre.org",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://www.treck.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://www.treck.com"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
ghsa-qrg2-552m-g38p
Vulnerability from github
Published
2022-05-24 17:20
Modified
2025-09-30 15:30
Severity ?
VLAI Severity ?
Details
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
{
"affected": [],
"aliases": [
"CVE-2020-11910"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-17T11:15:00Z",
"severity": "MODERATE"
},
"details": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.",
"id": "GHSA-qrg2-552m-g38p",
"modified": "2025-09-30T15:30:26Z",
"published": "2022-05-24T17:20:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11910"
},
{
"type": "WEB",
"url": "https://jsof-tech.com/vulnerability-disclosure-policy"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200625-0006"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
},
{
"type": "WEB",
"url": "https://www.jsof-tech.com/ripple20"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"type": "WEB",
"url": "https://www.treck.com"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
gsd-2020-11910
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-11910",
"description": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.",
"id": "GSD-2020-11910",
"references": [
"https://www.suse.com/security/cve/CVE-2020-11910.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-11910"
],
"details": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.",
"id": "GSD-2020-11910",
"modified": "2023-12-13T01:22:05.844846Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11910",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.kb.cert.org/vuls/id/257161/",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"name": "https://www.treck.com",
"refsource": "MISC",
"url": "https://www.treck.com"
},
{
"name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
"refsource": "MISC",
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"name": "VU#257161",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"name": "https://www.jsof-tech.com/ripple20/",
"refsource": "MISC",
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
"refsource": "CONFIRM",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
"refsource": "MISC",
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:treck:tcp\\/ip:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.1.66",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11910"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.treck.com",
"refsource": "MISC",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://www.treck.com"
},
{
"name": "https://jsof-tech.com/vulnerability-disclosure-policy/",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://jsof-tech.com/vulnerability-disclosure-policy/"
},
{
"name": "https://www.jsof-tech.com/ripple20/",
"refsource": "MISC",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"name": "https://www.kb.cert.org/vuls/id/257161/",
"refsource": "MISC",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.kb.cert.org/vuls/id/257161/"
},
{
"name": "20200617 Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020",
"refsource": "CISCO",
"tags": [
"Third Party Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"name": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200625-0006/",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.netapp.com/advisory/ntap-20200625-0006/"
},
{
"name": "VU#257161",
"refsource": "CERT-VN",
"tags": [],
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"name": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities",
"refsource": "MISC",
"tags": [],
"url": "https://www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
},
"lastModifiedDate": "2020-07-22T01:15Z",
"publishedDate": "2020-06-17T11:15Z"
}
}
}
wid-sec-w-2023-0683
Vulnerability from csaf_certbund
Published
2020-06-16 22:00
Modified
2023-03-19 23:00
Summary
Treck TCP/IP-Stack: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.
HP Laserjet ist die Laserdrucker-Produktreihe des Herstellers Hewlett Packard.
Die Server Firmware stellt die Software-Grundbetriebskomponenten für Mainboards bereit.
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Produkten, die die Treck TCP/IP-Stack-Bibliothek verwenden, ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- BIOS/Firmware
- Sonstiges
- Hardware Appliance
- Appliance
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.\r\nHP Laserjet ist die Laserdrucker-Produktreihe des Herstellers Hewlett Packard.\r\nDie Server Firmware stellt die Software-Grundbetriebskomponenten f\u00fcr Mainboards bereit.\r\nFreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Produkten, die die Treck TCP/IP-Stack-Bibliothek verwenden, ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herbeizuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- BIOS/Firmware\n- Sonstiges\n- Hardware Appliance\n- Appliance",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0683 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0683.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0683 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0683"
},
{
"category": "external",
"summary": "EATON Security Bulletin ETN-SB-2020-1008 vom 2023-03-17",
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/ETN-SB-2020-1008.pdf"
},
{
"category": "external",
"summary": "HPE Security Bulletins",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04103en_us"
},
{
"category": "external",
"summary": "Report auf Jsof-Tech.com vom 2020-06-16",
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"category": "external",
"summary": "Intel Security Advisory:INTEL-SA-00295 vom 2020-06-16",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
},
{
"category": "external",
"summary": "HP Security Bulletin HPSBPI03666 rev. 1 vom 2020-06-16",
"url": "https://support.hp.com/emea_africa-en/document/c06640149"
},
{
"category": "external",
"summary": "Schneider Electric Security Bulletin SESB-2020-168-01 vom 2020-06-16",
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01/"
},
{
"category": "external",
"summary": "ICS-Advisorys des Departments of Homeland Security vom 2020-06-16",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-168-01"
},
{
"category": "external",
"summary": "KB-Cert Vulnerability Note VU#257161 vom 2020-06-16",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"category": "external",
"summary": "Xerox Security Bulletin XRX20J vom 2020-06-16",
"url": "https://security.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20J_for_B2XX.pdf"
},
{
"category": "external",
"summary": "Cisco Security Advisory CISCO-SA-TRECK-IP-STACK-JYBQ5GYC vom 2020-06-17",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "EMC Security Advisory SLN321836 vom 2020-06-22",
"url": "https://www.dell.com/support/article/sln321836/dell-response-to-the-ripple20-vulnerabilities?lang=en"
},
{
"category": "external",
"summary": "Aruba Product Security Advisory",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"category": "external",
"summary": "EMC Security Advisory DSA-2020-150 vom 2020-06-25",
"url": "https://www.dell.com/support/article/sln321835/dsa-2020-150-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards?lang=en"
},
{
"category": "external",
"summary": "Palo Alto Networks Security Advisory PAN-SA-2020-0007 vom 2020-07-08",
"url": "https://security.paloaltonetworks.com/PAN-SA-2020-0007"
},
{
"category": "external",
"summary": "HPE SECURITY BULLETIN HPESBHF04012 rev.1 vom 2020-07-13",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us"
},
{
"category": "external",
"summary": "HPE SECURITY BULLETIN HPESBHF04012 rev.2 vom 2020-08-14",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us"
},
{
"category": "external",
"summary": "HPE Security Bulletin hpesbhf04021en_us vom 2020-10-06",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04021en_us"
},
{
"category": "external",
"summary": "EMC Security Advisory DSA-2020-206 vom 2021-02-24",
"url": "https://www.dell.com/support/kbdoc/de-de/000125440/dsa-2020-206-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards"
}
],
"source_lang": "en-US",
"title": "Treck TCP/IP-Stack: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-03-19T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:46:53.196+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0683",
"initial_release_date": "2020-06-16T22:00:00.000+00:00",
"revision_history": [
{
"date": "2020-06-16T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-06-17T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Cisco aufgenommen"
},
{
"date": "2020-06-21T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von EMC aufgenommen"
},
{
"date": "2020-06-23T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2020-06-24T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von EMC aufgenommen"
},
{
"date": "2020-07-08T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Informationen von Palo Alto Networks aufgenommen"
},
{
"date": "2020-07-14T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2020-08-17T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2020-10-07T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2021-02-23T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von DELL aufgenommen"
},
{
"date": "2021-03-25T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von HP aufgenommen"
},
{
"date": "2023-03-19T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von EATON aufgenommen"
}
],
"status": "final",
"version": "12"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Aruba ArubaOS",
"product": {
"name": "Aruba ArubaOS",
"product_id": "T016785",
"product_identification_helper": {
"cpe": "cpe:/o:arubanetworks:arubaos:-"
}
}
},
{
"category": "product_name",
"name": "Aruba Switch",
"product": {
"name": "Aruba Switch",
"product_id": "T016786",
"product_identification_helper": {
"cpe": "cpe:/h:arubanetworks:switch:-"
}
}
}
],
"category": "vendor",
"name": "Aruba"
},
{
"branches": [
{
"category": "product_name",
"name": "Cisco Router",
"product": {
"name": "Cisco Router",
"product_id": "T003258",
"product_identification_helper": {
"cpe": "cpe:/h:cisco:router:-"
}
}
}
],
"category": "vendor",
"name": "Cisco"
},
{
"branches": [
{
"category": "product_name",
"name": "Dell Computer",
"product": {
"name": "Dell Computer",
"product_id": "T006498",
"product_identification_helper": {
"cpe": "cpe:/o:dell:dell_computer:-"
}
}
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "Eaton UPS",
"product": {
"name": "Eaton UPS",
"product_id": "T026792",
"product_identification_helper": {
"cpe": "cpe:/h:eaton:ups:-"
}
}
}
],
"category": "vendor",
"name": "Eaton"
},
{
"branches": [
{
"category": "product_name",
"name": "HP LaserJet",
"product": {
"name": "HP LaserJet",
"product_id": "T016741",
"product_identification_helper": {
"cpe": "cpe:/h:hp:laserjet:-"
}
}
}
],
"category": "vendor",
"name": "HP"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "HPE Integrated Lights-Out 3",
"product": {
"name": "HPE Integrated Lights-Out 3",
"product_id": "T012638",
"product_identification_helper": {
"cpe": "cpe:/h:hp:integrated_lights-out:3"
}
}
},
{
"category": "product_name",
"name": "HPE Integrated Lights-Out 5",
"product": {
"name": "HPE Integrated Lights-Out 5",
"product_id": "T012756",
"product_identification_helper": {
"cpe": "cpe:/h:hp:integrated_lights-out:5"
}
}
}
],
"category": "product_name",
"name": "Integrated Lights-Out"
},
{
"category": "product_name",
"name": "HPE ProLiant",
"product": {
"name": "HPE ProLiant",
"product_id": "T009310",
"product_identification_helper": {
"cpe": "cpe:/h:hp:proliant:-"
}
}
}
],
"category": "vendor",
"name": "HPE"
},
{
"branches": [
{
"category": "product_name",
"name": "Intel BIOS",
"product": {
"name": "Intel BIOS",
"product_id": "T016742",
"product_identification_helper": {
"cpe": "cpe:/h:intel:bios:-"
}
}
},
{
"category": "product_name",
"name": "Intel Server Firmware",
"product": {
"name": "Intel Server Firmware",
"product_id": "T004050",
"product_identification_helper": {
"cpe": "cpe:/h:intel:server_firmware:-"
}
}
}
],
"category": "vendor",
"name": "Intel"
},
{
"branches": [
{
"category": "product_name",
"name": "PaloAlto Networks PAN-OS",
"product": {
"name": "PaloAlto Networks PAN-OS",
"product_id": "T012790",
"product_identification_helper": {
"cpe": "cpe:/o:paloaltonetworks:pan-os:-"
}
}
}
],
"category": "vendor",
"name": "PaloAlto Networks"
},
{
"branches": [
{
"category": "product_name",
"name": "Xerox FreeFlow Print Server",
"product": {
"name": "Xerox FreeFlow Print Server",
"product_id": "T016743",
"product_identification_helper": {
"cpe": "cpe:/a:xerox:freeflow_print_server:-"
}
}
}
],
"category": "vendor",
"name": "Xerox"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11896"
},
{
"cve": "CVE-2020-11897",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11897"
},
{
"cve": "CVE-2020-11898",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11898"
},
{
"cve": "CVE-2020-11899",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11899"
},
{
"cve": "CVE-2020-11900",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11900"
},
{
"cve": "CVE-2020-11901",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11901"
},
{
"cve": "CVE-2020-11902",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11902"
},
{
"cve": "CVE-2020-11903",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11903"
},
{
"cve": "CVE-2020-11904",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11904"
},
{
"cve": "CVE-2020-11905",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11905"
},
{
"cve": "CVE-2020-11906",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11906"
},
{
"cve": "CVE-2020-11907",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11907"
},
{
"cve": "CVE-2020-11908",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11908"
},
{
"cve": "CVE-2020-11909",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11909"
},
{
"cve": "CVE-2020-11910",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11910"
},
{
"cve": "CVE-2020-11911",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11911"
},
{
"cve": "CVE-2020-11912",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11912"
},
{
"cve": "CVE-2020-11913",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11913"
},
{
"cve": "CVE-2020-11914",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11914"
}
]
}
WID-SEC-W-2023-0683
Vulnerability from csaf_certbund
Published
2020-06-16 22:00
Modified
2023-03-19 23:00
Summary
Treck TCP/IP-Stack: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.
HP Laserjet ist die Laserdrucker-Produktreihe des Herstellers Hewlett Packard.
Die Server Firmware stellt die Software-Grundbetriebskomponenten für Mainboards bereit.
FreeFlow-Druckserver ist eine Druckserveranwendung für Xerox-Produktionsdrucker, die Flexibilität, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Produkten, die die Treck TCP/IP-Stack-Bibliothek verwenden, ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- MacOS X
- Windows
- BIOS/Firmware
- Sonstiges
- Hardware Appliance
- Appliance
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.\r\nHP Laserjet ist die Laserdrucker-Produktreihe des Herstellers Hewlett Packard.\r\nDie Server Firmware stellt die Software-Grundbetriebskomponenten f\u00fcr Mainboards bereit.\r\nFreeFlow-Druckserver ist eine Druckserveranwendung f\u00fcr Xerox-Produktionsdrucker, die Flexibilit\u00e4t, umfangreiche Workflow-Optionen und eine Farbverwaltung bietet.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Produkten, die die Treck TCP/IP-Stack-Bibliothek verwenden, ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herbeizuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- UNIX\n- Linux\n- MacOS X\n- Windows\n- BIOS/Firmware\n- Sonstiges\n- Hardware Appliance\n- Appliance",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0683 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0683.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0683 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0683"
},
{
"category": "external",
"summary": "EATON Security Bulletin ETN-SB-2020-1008 vom 2023-03-17",
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/ETN-SB-2020-1008.pdf"
},
{
"category": "external",
"summary": "HPE Security Bulletins",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04103en_us"
},
{
"category": "external",
"summary": "Report auf Jsof-Tech.com vom 2020-06-16",
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"category": "external",
"summary": "Intel Security Advisory:INTEL-SA-00295 vom 2020-06-16",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html"
},
{
"category": "external",
"summary": "HP Security Bulletin HPSBPI03666 rev. 1 vom 2020-06-16",
"url": "https://support.hp.com/emea_africa-en/document/c06640149"
},
{
"category": "external",
"summary": "Schneider Electric Security Bulletin SESB-2020-168-01 vom 2020-06-16",
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01/"
},
{
"category": "external",
"summary": "ICS-Advisorys des Departments of Homeland Security vom 2020-06-16",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-168-01"
},
{
"category": "external",
"summary": "KB-Cert Vulnerability Note VU#257161 vom 2020-06-16",
"url": "https://www.kb.cert.org/vuls/id/257161"
},
{
"category": "external",
"summary": "Xerox Security Bulletin XRX20J vom 2020-06-16",
"url": "https://security.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20J_for_B2XX.pdf"
},
{
"category": "external",
"summary": "Cisco Security Advisory CISCO-SA-TRECK-IP-STACK-JYBQ5GYC vom 2020-06-17",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"category": "external",
"summary": "EMC Security Advisory SLN321836 vom 2020-06-22",
"url": "https://www.dell.com/support/article/sln321836/dell-response-to-the-ripple20-vulnerabilities?lang=en"
},
{
"category": "external",
"summary": "Aruba Product Security Advisory",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"category": "external",
"summary": "EMC Security Advisory DSA-2020-150 vom 2020-06-25",
"url": "https://www.dell.com/support/article/sln321835/dsa-2020-150-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards?lang=en"
},
{
"category": "external",
"summary": "Palo Alto Networks Security Advisory PAN-SA-2020-0007 vom 2020-07-08",
"url": "https://security.paloaltonetworks.com/PAN-SA-2020-0007"
},
{
"category": "external",
"summary": "HPE SECURITY BULLETIN HPESBHF04012 rev.1 vom 2020-07-13",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us"
},
{
"category": "external",
"summary": "HPE SECURITY BULLETIN HPESBHF04012 rev.2 vom 2020-08-14",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us"
},
{
"category": "external",
"summary": "HPE Security Bulletin hpesbhf04021en_us vom 2020-10-06",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04021en_us"
},
{
"category": "external",
"summary": "EMC Security Advisory DSA-2020-206 vom 2021-02-24",
"url": "https://www.dell.com/support/kbdoc/de-de/000125440/dsa-2020-206-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards"
}
],
"source_lang": "en-US",
"title": "Treck TCP/IP-Stack: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-03-19T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:46:53.196+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0683",
"initial_release_date": "2020-06-16T22:00:00.000+00:00",
"revision_history": [
{
"date": "2020-06-16T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-06-17T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Cisco aufgenommen"
},
{
"date": "2020-06-21T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von EMC aufgenommen"
},
{
"date": "2020-06-23T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2020-06-24T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von EMC aufgenommen"
},
{
"date": "2020-07-08T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Informationen von Palo Alto Networks aufgenommen"
},
{
"date": "2020-07-14T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2020-08-17T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2020-10-07T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von HPE aufgenommen"
},
{
"date": "2021-02-23T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von DELL aufgenommen"
},
{
"date": "2021-03-25T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von HP aufgenommen"
},
{
"date": "2023-03-19T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von EATON aufgenommen"
}
],
"status": "final",
"version": "12"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Aruba ArubaOS",
"product": {
"name": "Aruba ArubaOS",
"product_id": "T016785",
"product_identification_helper": {
"cpe": "cpe:/o:arubanetworks:arubaos:-"
}
}
},
{
"category": "product_name",
"name": "Aruba Switch",
"product": {
"name": "Aruba Switch",
"product_id": "T016786",
"product_identification_helper": {
"cpe": "cpe:/h:arubanetworks:switch:-"
}
}
}
],
"category": "vendor",
"name": "Aruba"
},
{
"branches": [
{
"category": "product_name",
"name": "Cisco Router",
"product": {
"name": "Cisco Router",
"product_id": "T003258",
"product_identification_helper": {
"cpe": "cpe:/h:cisco:router:-"
}
}
}
],
"category": "vendor",
"name": "Cisco"
},
{
"branches": [
{
"category": "product_name",
"name": "Dell Computer",
"product": {
"name": "Dell Computer",
"product_id": "T006498",
"product_identification_helper": {
"cpe": "cpe:/o:dell:dell_computer:-"
}
}
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "Eaton UPS",
"product": {
"name": "Eaton UPS",
"product_id": "T026792",
"product_identification_helper": {
"cpe": "cpe:/h:eaton:ups:-"
}
}
}
],
"category": "vendor",
"name": "Eaton"
},
{
"branches": [
{
"category": "product_name",
"name": "HP LaserJet",
"product": {
"name": "HP LaserJet",
"product_id": "T016741",
"product_identification_helper": {
"cpe": "cpe:/h:hp:laserjet:-"
}
}
}
],
"category": "vendor",
"name": "HP"
},
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "HPE Integrated Lights-Out 3",
"product": {
"name": "HPE Integrated Lights-Out 3",
"product_id": "T012638",
"product_identification_helper": {
"cpe": "cpe:/h:hp:integrated_lights-out:3"
}
}
},
{
"category": "product_name",
"name": "HPE Integrated Lights-Out 5",
"product": {
"name": "HPE Integrated Lights-Out 5",
"product_id": "T012756",
"product_identification_helper": {
"cpe": "cpe:/h:hp:integrated_lights-out:5"
}
}
}
],
"category": "product_name",
"name": "Integrated Lights-Out"
},
{
"category": "product_name",
"name": "HPE ProLiant",
"product": {
"name": "HPE ProLiant",
"product_id": "T009310",
"product_identification_helper": {
"cpe": "cpe:/h:hp:proliant:-"
}
}
}
],
"category": "vendor",
"name": "HPE"
},
{
"branches": [
{
"category": "product_name",
"name": "Intel BIOS",
"product": {
"name": "Intel BIOS",
"product_id": "T016742",
"product_identification_helper": {
"cpe": "cpe:/h:intel:bios:-"
}
}
},
{
"category": "product_name",
"name": "Intel Server Firmware",
"product": {
"name": "Intel Server Firmware",
"product_id": "T004050",
"product_identification_helper": {
"cpe": "cpe:/h:intel:server_firmware:-"
}
}
}
],
"category": "vendor",
"name": "Intel"
},
{
"branches": [
{
"category": "product_name",
"name": "PaloAlto Networks PAN-OS",
"product": {
"name": "PaloAlto Networks PAN-OS",
"product_id": "T012790",
"product_identification_helper": {
"cpe": "cpe:/o:paloaltonetworks:pan-os:-"
}
}
}
],
"category": "vendor",
"name": "PaloAlto Networks"
},
{
"branches": [
{
"category": "product_name",
"name": "Xerox FreeFlow Print Server",
"product": {
"name": "Xerox FreeFlow Print Server",
"product_id": "T016743",
"product_identification_helper": {
"cpe": "cpe:/a:xerox:freeflow_print_server:-"
}
}
}
],
"category": "vendor",
"name": "Xerox"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11896"
},
{
"cve": "CVE-2020-11897",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11897"
},
{
"cve": "CVE-2020-11898",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11898"
},
{
"cve": "CVE-2020-11899",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11899"
},
{
"cve": "CVE-2020-11900",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11900"
},
{
"cve": "CVE-2020-11901",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11901"
},
{
"cve": "CVE-2020-11902",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11902"
},
{
"cve": "CVE-2020-11903",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11903"
},
{
"cve": "CVE-2020-11904",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11904"
},
{
"cve": "CVE-2020-11905",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11905"
},
{
"cve": "CVE-2020-11906",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11906"
},
{
"cve": "CVE-2020-11907",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11907"
},
{
"cve": "CVE-2020-11908",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11908"
},
{
"cve": "CVE-2020-11909",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11909"
},
{
"cve": "CVE-2020-11910",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11910"
},
{
"cve": "CVE-2020-11911",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11911"
},
{
"cve": "CVE-2020-11912",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11912"
},
{
"cve": "CVE-2020-11913",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11913"
},
{
"cve": "CVE-2020-11914",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als \"Ripple20\" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei L\u00e4ngenparametern, einer unsachgem\u00e4\u00dfen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-\u00dcberlaufen oder Wraparounds, einer unsachgem\u00e4\u00dfen Null-Terminierung, sowie einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuf\u00fchren oder einen Denial of Service Zustand herzustellen."
}
],
"product_status": {
"known_affected": [
"T006498",
"T012638",
"T012756",
"T003258",
"T016743",
"T016742",
"T016786",
"T016741",
"T016785",
"T012790",
"T004050",
"T009310",
"T026792"
]
},
"release_date": "2020-06-16T22:00:00.000+00:00",
"title": "CVE-2020-11914"
}
]
}
ICSA-20-168-01
Vulnerability from csaf_cisa
Published
2020-06-16 06:00
Modified
2024-09-19 06:00
Summary
Treck TCP/IP (Update I)
Notes
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow remote code execution or exposure of sensitive information.
Critical infrastructure sectors
Energy, Critical Manufacturing, Information Technology, Healthcare and Public Health, Transportation Systems
Countries/areas deployed
Worldwide
Company headquarters location
United States
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
Recommended Practices
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. This vulnerability has a high attack complexity.
{
"document": {
"acknowledgments": [
{
"names": [
"Shlomi Oberman",
"Moshe Kol"
],
"organization": "JSOF",
"summary": "reporting these vulnerabilities to CERT/CC"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities may allow remote code execution or exposure of sensitive information.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Energy, Critical Manufacturing, Information Technology, Healthcare and Public Health, Transportation Systems",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "United States",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. This vulnerability has a high attack complexity.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-20-168-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-168-01.json"
},
{
"category": "self",
"summary": "ICSA Advisory ICSA-20-168-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-168-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
}
],
"title": "Treck TCP/IP (Update I)",
"tracking": {
"current_release_date": "2024-09-19T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-20-168-01",
"initial_release_date": "2020-06-16T06:00:00.000000Z",
"revision_history": [
{
"date": "2020-06-16T06:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "Initial Publication"
},
{
"date": "2020-06-18T06:00:00.000000Z",
"legacy_version": "Update A",
"number": "2",
"summary": "Update A - ICSA-20-168-01 Treck TCP-IP Stack (Update A)"
},
{
"date": "2020-06-30T06:00:00.000000Z",
"legacy_version": "Update B",
"number": "3",
"summary": "Update B - ICSA-20-168-01 Treck TCP/IP Stack (Update B)"
},
{
"date": "2020-07-07T06:00:00.000000Z",
"legacy_version": "Update C",
"number": "4",
"summary": "Update C - ICSA-20-168-01 Treck TCP-IP Stack (Update C)"
},
{
"date": "2020-07-14T06:00:00.000000Z",
"legacy_version": "Update D",
"number": "5",
"summary": "Update D - ICSA-20-168-01 Treck TCP/IP Stack (Update D)"
},
{
"date": "2020-07-21T06:00:00.000000Z",
"legacy_version": "Update E",
"number": "6",
"summary": "Update E - ICSA-20-168-01 Treck TCP/IP Stack (Update E)"
},
{
"date": "2020-08-04T06:00:00.000000Z",
"legacy_version": "Update F",
"number": "7",
"summary": "Update F - ICSA-20-168-01 Treck TCP-IP Stack (Update F)"
},
{
"date": "2020-08-20T06:00:00.000000Z",
"legacy_version": "Update G",
"number": "8",
"summary": "Update G - ICSA-20-168-01 Treck TCP/IP Stack (Update G)"
},
{
"date": "2022-03-17T06:00:00.000000Z",
"legacy_version": "Update H",
"number": "9",
"summary": "Update H - ICSA-20-168-01 Treck TCP/IP Stack (Update H)"
},
{
"date": "2024-09-19T06:00:00.000000Z",
"legacy_version": "Update I",
"number": "10",
"summary": "Update I - Included IDEC Corporation."
}
],
"status": "final",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "IPv4",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: IPv4",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "IPv6",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: IPv6",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "UDP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: UDP",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "DNS",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: DNS",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "DHCP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: DHCP",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "TCP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: TCP",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "ICMPv4",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: ICMPv4",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "ARP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: ARP",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
}
],
"category": "vendor",
"name": "Treck Inc."
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv4/UDP component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11897",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in possible out-of-bounds write.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11897"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11898",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv4/ICMPv4 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11899",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read and a possible denial of service.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11899"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11900",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "Possible double free in IPv4 tunneling component when handling a packet sent by a network attacker. This vulnerability may result in use after free.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11900"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11901",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in DNS resolver component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11901"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11902",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 over IPv4 tunneling component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11902"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11903",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Possible out-of-bounds read in DHCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11903"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11904",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "Possible integer overflow or wraparound in memory allocation component when handling a packet sent by an unauthorized network attacker may result in out-of-bounds write.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11904"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11905",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Possible out-of-bounds read in DHCPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11905"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11906",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation CWE-20 in ethernet link layer component from a packet sent by an unauthorized user. ",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11906"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11907",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in TCP component, from a packet sent by an unauthorized network attacker.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11907"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11908",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"notes": [
{
"category": "summary",
"text": "Improper null termination in DHCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11908"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11909",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv4 component when handling a packet sent by an unauthorized network attacker.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11909"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11910",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in ICMPv4 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11910"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11911",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to improper access control, which may allow an attacker to change one specific configuration value.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11911"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11912",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in TCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11912"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11913",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11913"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11914",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in ARP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11914"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
}
]
}
icsa-20-168-01
Vulnerability from csaf_cisa
Published
2020-06-16 06:00
Modified
2024-09-19 06:00
Summary
Treck TCP/IP (Update I)
Notes
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of these vulnerabilities may allow remote code execution or exposure of sensitive information.
Critical infrastructure sectors
Energy, Critical Manufacturing, Information Technology, Healthcare and Public Health, Transportation Systems
Countries/areas deployed
Worldwide
Company headquarters location
United States
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
Recommended Practices
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. This vulnerability has a high attack complexity.
{
"document": {
"acknowledgments": [
{
"names": [
"Shlomi Oberman",
"Moshe Kol"
],
"organization": "JSOF",
"summary": "reporting these vulnerabilities to CERT/CC"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities may allow remote code execution or exposure of sensitive information.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Energy, Critical Manufacturing, Information Technology, Healthcare and Public Health, Transportation Systems",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "United States",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "When remote access is required, use more secure methods, such as virtual private networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. This vulnerability has a high attack complexity.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-20-168-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-168-01.json"
},
{
"category": "self",
"summary": "ICSA Advisory ICSA-20-168-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-168-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
}
],
"title": "Treck TCP/IP (Update I)",
"tracking": {
"current_release_date": "2024-09-19T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-20-168-01",
"initial_release_date": "2020-06-16T06:00:00.000000Z",
"revision_history": [
{
"date": "2020-06-16T06:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "Initial Publication"
},
{
"date": "2020-06-18T06:00:00.000000Z",
"legacy_version": "Update A",
"number": "2",
"summary": "Update A - ICSA-20-168-01 Treck TCP-IP Stack (Update A)"
},
{
"date": "2020-06-30T06:00:00.000000Z",
"legacy_version": "Update B",
"number": "3",
"summary": "Update B - ICSA-20-168-01 Treck TCP/IP Stack (Update B)"
},
{
"date": "2020-07-07T06:00:00.000000Z",
"legacy_version": "Update C",
"number": "4",
"summary": "Update C - ICSA-20-168-01 Treck TCP-IP Stack (Update C)"
},
{
"date": "2020-07-14T06:00:00.000000Z",
"legacy_version": "Update D",
"number": "5",
"summary": "Update D - ICSA-20-168-01 Treck TCP/IP Stack (Update D)"
},
{
"date": "2020-07-21T06:00:00.000000Z",
"legacy_version": "Update E",
"number": "6",
"summary": "Update E - ICSA-20-168-01 Treck TCP/IP Stack (Update E)"
},
{
"date": "2020-08-04T06:00:00.000000Z",
"legacy_version": "Update F",
"number": "7",
"summary": "Update F - ICSA-20-168-01 Treck TCP-IP Stack (Update F)"
},
{
"date": "2020-08-20T06:00:00.000000Z",
"legacy_version": "Update G",
"number": "8",
"summary": "Update G - ICSA-20-168-01 Treck TCP/IP Stack (Update G)"
},
{
"date": "2022-03-17T06:00:00.000000Z",
"legacy_version": "Update H",
"number": "9",
"summary": "Update H - ICSA-20-168-01 Treck TCP/IP Stack (Update H)"
},
{
"date": "2024-09-19T06:00:00.000000Z",
"legacy_version": "Update I",
"number": "10",
"summary": "Update I - Included IDEC Corporation."
}
],
"status": "final",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "IPv4",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: IPv4",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "IPv6",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: IPv6",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "UDP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: UDP",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "DNS",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: DNS",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "DHCP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: DHCP",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "TCP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: TCP",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "ICMPv4",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: ICMPv4",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
},
{
"branches": [
{
"category": "product_version",
"name": "ARP",
"product": {
"name": "Treck Inc. Treck Inc TCP/IP: ARP",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "Treck Inc TCP/IP"
}
],
"category": "vendor",
"name": "Treck Inc."
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11896",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv4/UDP component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11897",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in possible out-of-bounds write.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11897"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11898",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in IPv4/ICMPv4 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11899",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read and a possible denial of service.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11899"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11900",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "summary",
"text": "Possible double free in IPv4 tunneling component when handling a packet sent by a network attacker. This vulnerability may result in use after free.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11900"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11901",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in DNS resolver component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11901"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11902",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 over IPv4 tunneling component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11902"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11903",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Possible out-of-bounds read in DHCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11903"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11904",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "Possible integer overflow or wraparound in memory allocation component when handling a packet sent by an unauthorized network attacker may result in out-of-bounds write.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11904"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11905",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "Possible out-of-bounds read in DHCPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11905"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11906",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation CWE-20 in ethernet link layer component from a packet sent by an unauthorized user. ",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11906"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11907",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"notes": [
{
"category": "summary",
"text": "Improper handling of length parameter inconsistency in TCP component, from a packet sent by an unauthorized network attacker.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11907"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11908",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"notes": [
{
"category": "summary",
"text": "Improper null termination in DHCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11908"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11909",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv4 component when handling a packet sent by an unauthorized network attacker.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11909"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11910",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in ICMPv4 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11910"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11911",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to improper access control, which may allow an attacker to change one specific configuration value.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11911"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11912",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in TCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11912"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11913",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11913"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
},
{
"cve": "CVE-2020-11914",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "summary",
"text": "Improper input validation in ARP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
"references": [
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11914"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Treck recommends users apply the latest version of the affected products:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "Treck TCP/IP: Update to 6.0.1.67 or later versions",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "To obtain patches, email Treck at security@treck.com",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "mailto:security@treck.com"
},
{
"category": "mitigation",
"details": "For more detailed information on the vulnerabilities and the mitigating controls, please see the Treck advisory.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1508.html"
},
{
"category": "mitigation",
"details": "Additional vendors affected by the reported vulnerabilities have also released security advisories related to their affected products. Those advisories are as follows:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
},
{
"category": "mitigation",
"details": "ABB",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://search.abb.com/library/Download.aspx?DocumentID=1MRS494936A\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
},
{
"category": "mitigation",
"details": "B.Braun",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bbraunusa.com/en/products-and-therapies/customer-communications.html"
},
{
"category": "mitigation",
"details": "Baxter",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.baxter.com/product-security#additionalresources"
},
{
"category": "mitigation",
"details": "BD",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletins/third-party-product-security-bulletin-for-treck-tcp-ip-stack-vulnerabilities"
},
{
"category": "mitigation",
"details": "CareStream",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy"
},
{
"category": "mitigation",
"details": "Caterpillar",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.cat.com/en_US/support/technology/connected-solutions-principles/security/caterpillar-cybersecurity-advisory.html"
},
{
"category": "mitigation",
"details": "DIGI International",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.digi.com/support/knowledge-base/digi-international-security-notice-treck-tcp-ip-st"
},
{
"category": "mitigation",
"details": "Eaton",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-security-bulletin-treck-tcp-ip-stack-vulnerabilities-ripple20.pdf"
},
{
"category": "mitigation",
"details": "Green Hills Software",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"category": "mitigation",
"details": "IDEC Corporation",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://us.idec.com/media/24-RD-0300-EN.pdf"
},
{
"category": "mitigation",
"details": "Johnson Controls",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
},
{
"category": "mitigation",
"details": "Miele",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-024"
},
{
"category": "mitigation",
"details": "Opto 22",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.opto22.com/support/resources-tools/knowledgebase/kb88981"
},
{
"category": "mitigation",
"details": "Pepperl+Fuchs",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://cert.vde.com/en/advisories/VDE-2021-028/"
},
{
"category": "mitigation",
"details": "Rockwell",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1126896"
},
{
"category": "mitigation",
"details": "Schneider Electric",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.se.com/ww/en/download/document/SESB-2020-168-01"
},
{
"category": "mitigation",
"details": "Smiths Medical",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
],
"url": "https://www.smiths-medical.com/company-information/news-and-events/news/2020/july/02/smiths-medical-cybersecurity-bulletin"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008"
]
}
]
}
]
}
cnvd-2020-34242
Vulnerability from cnvd
Title
Treck TCP/IP ICMPv4组件输入验证错误漏洞
Description
Treck TCP/IP是美国Treck公司的一套专用于嵌入式系统的TCP（传输控制协议）/IP（网际互连协议）套件。Treck ICMPv4 stack是美国Treck公司的一款用于嵌入式系统的ICMPv4（IPv4互联网控制消息协议）实现。
Treck TCP/IP ICMPv4组件存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。攻击者可利用该漏洞导致越界读取。
Severity
低
VLAI Severity ?
Patch Name
Treck TCP/IP ICMPv4组件输入验证错误漏洞的补丁
Patch Description
Treck TCP/IP是美国Treck公司的一套专用于嵌入式系统的TCP（传输控制协议）/IP（网际互连协议）套件。Treck ICMPv4 stack是美国Treck公司的一款用于嵌入式系统的ICMPv4（IPv4互联网控制消息协议）实现。
Treck TCP/IP ICMPv4组件存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。攻击者可利用该漏洞导致越界读取。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://treck.com/vulnerability-response-information/
Reference
https://www.us-cert.gov/ics/advisories/icsa-20-168-01
Impacted products
| Name | Treck TCP/IP stack <6.0.1.66 |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2020-11910"
}
},
"description": "Treck TCP/IP\u662f\u7f8e\u56fdTreck\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u7684TCP\uff08\u4f20\u8f93\u63a7\u5236\u534f\u8bae\uff09/IP\uff08\u7f51\u9645\u4e92\u8fde\u534f\u8bae\uff09\u5957\u4ef6\u3002Treck ICMPv4 stack\u662f\u7f8e\u56fdTreck\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u7684ICMPv4\uff08IPv4\u4e92\u8054\u7f51\u63a7\u5236\u6d88\u606f\u534f\u8bae\uff09\u5b9e\u73b0\u3002\n\nTreck TCP/IP ICMPv4\u7ec4\u4ef6\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684\u6570\u636e\u8fdb\u884c\u6b63\u786e\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8d8a\u754c\u8bfb\u53d6\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://treck.com/vulnerability-response-information/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2020-34242",
"openTime": "2020-06-18",
"patchDescription": "Treck TCP/IP\u662f\u7f8e\u56fdTreck\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u7684TCP\uff08\u4f20\u8f93\u63a7\u5236\u534f\u8bae\uff09/IP\uff08\u7f51\u9645\u4e92\u8fde\u534f\u8bae\uff09\u5957\u4ef6\u3002Treck ICMPv4 stack\u662f\u7f8e\u56fdTreck\u516c\u53f8\u7684\u4e00\u6b3e\u7528\u4e8e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u7684ICMPv4\uff08IPv4\u4e92\u8054\u7f51\u63a7\u5236\u6d88\u606f\u534f\u8bae\uff09\u5b9e\u73b0\u3002\r\n\r\nTreck TCP/IP ICMPv4\u7ec4\u4ef6\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u5bf9\u8f93\u5165\u7684\u6570\u636e\u8fdb\u884c\u6b63\u786e\u7684\u9a8c\u8bc1\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u8d8a\u754c\u8bfb\u53d6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Treck TCP/IP ICMPv4\u7ec4\u4ef6\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Treck TCP/IP stack \u003c6.0.1.66"
},
"referenceLink": "https://www.us-cert.gov/ics/advisories/icsa-20-168-01",
"serverity": "\u4f4e",
"submitTime": "2020-06-17",
"title": "Treck TCP/IP ICMPv4\u7ec4\u4ef6\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e"
}
CERTFR-2020-AVI-375
Vulnerability from certfr_avis
Le 16 juin 2020, des chercheurs ont annoncé la découverte de dix-neuf vulnérabilités dans l'implémentation de la pile TCP/IP de Treck.
Ce composant est utilisé dans de nombreux systèmes embarqués et objets connectés, dont certains équipements médicaux et équipements de contrôle industriel. Les vulnérabilités les plus critiques permettent une exécution de code arbitraire à distance.
Lorsque des vulnérabilités sont découvertes dans un composant d'aussi bas niveau, il est très difficile de compiler une liste exhaustive de produits vulnérables. De plus, la simple présence de ce composant dans un produit n'implique pas forcément que celui-ci est vulnérable, parce que la vulnérabilité a déjà été corrigée ou encore parce que ce composant a été modifié et que la vulnérabilité n'est pas forcément atteignable.
Le CERT Carneggie Mellon ainsi que les chercheurs ont proposé sur leurs sites respectifs une liste de produits vulnérables et certains éditeurs ont déjà communiqué sur le statut de leurs produits (cf. section Documentation).
Parmi les dix-neuf vulnérabilités, les trois les plus critiques sont identifiées comme :
- CVE-2020-11896 : des datagrammes UDP fragmentés sur plusieurs paquets IP peuvent permettre un exécution de code arbitraire à distance ou un déni de service à distance sur des équipements avec une fonction d'IP Tunneling activée ;
- CVE-2020-11897 : des paquets IPv6 mal formés permettent une exécution de code arbitraire à distance [1] ;
- CVE-2020-11901 : une réponse DNS mal formée permet une exécution de code arbitraire à distance.
Si ces vulnérabilités sont jugées critiques, leur impact est atténué par les conditions d’exploitabilité.
Il convient donc de vérifier dans un premier temps si les équipements en bordure de réseau sont dans une configuration vulnérable. Si c'est le cas, il faut alors appliquer les mises à jour si elles sont disponibles ou mettre en œuvre les mesures de contournement.
[mise à jour du 26 octobre 2020] Les avis de sécurité Schneider Electric SEVD-2020-174-01 et SEVD-2020-175-01 ont été mis à jour le 22 octobre 2020 suite à la découverte d'impacts supplémentaires sur les produits Schneider. Des correctifs sont en cours de développement, certains ont déjà été publiés et des mesures de contournement sont identifiées et listées dans les avis à jour.
[1] cette vulnérabilité a été corrigée dans la version 5.0.1.35, sans être accompagnée d'un avis de sécurité à l'époque de sa mise à disposition.
Solution
Se référer au bulletin de sécurité des éditeurs pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "versions de la pile TCP/IP de Treck ant\u00e9rieures \u00e0 6.0.1.66",
"product": {
"name": "N/A",
"vendor": {
"name": "N/A",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-11913",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11913"
},
{
"name": "CVE-2020-11910",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11910"
},
{
"name": "CVE-2020-11899",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11899"
},
{
"name": "CVE-2020-11908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11908"
},
{
"name": "CVE-2020-11906",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11906"
},
{
"name": "CVE-2020-11914",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11914"
},
{
"name": "CVE-2020-11897",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11897"
},
{
"name": "CVE-2020-11911",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11911"
},
{
"name": "CVE-2020-11900",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11900"
},
{
"name": "CVE-2020-11903",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11903"
},
{
"name": "CVE-2020-11912",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11912"
},
{
"name": "CVE-2020-11901",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11901"
},
{
"name": "CVE-2020-11904",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11904"
},
{
"name": "CVE-2020-11907",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11907"
},
{
"name": "CVE-2020-11905",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11905"
},
{
"name": "CVE-2020-11898",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
},
{
"name": "CVE-2020-11896",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
},
{
"name": "CVE-2020-11909",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11909"
},
{
"name": "CVE-2020-11902",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11902"
}
],
"initial_release_date": "2021-01-08T00:00:00",
"last_revision_date": "2021-01-08T00:00:00",
"links": [
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11903",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11903"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11905",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11905"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-174-01 du 22 juin 2020, mis \u00e0 jour le 23 juin 2020 et mis \u00e0 jour le 22 octobre 2020",
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-174-01/"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-175-01 du 23 juin 2020 mis \u00e0 jour le 22 octobre 2020",
"url": "https://www.se.com/ww/en/download/document/SEVD-2020-175-01/"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11911",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11911"
},
{
"title": "Annonce de Moxa du 30 juin 2020",
"url": "https://www.moxa.com/en/support/support/security-advisory/moxas-response-regarding-the-ripple20-vulnerabilities"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11902",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11902"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Aruba ARUBA-PSA-2020-006 du 23 juin 2020",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt"
},
{
"title": "Communication de Green Hills Software du 16 juin 2020",
"url": "https://support.ghs.com/psirt/PSA-2020-05/"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11897",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11897"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Treck du 16 juin 2020",
"url": "https://treck.com/vulnerability-response-information/"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11908",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11908"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11907",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11907"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11910",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11910"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks PAN-SA-2020-0007 du 08 juillet 2020",
"url": "https://security.paloaltonetworks.com/PAN-SA-2020-0007"
},
{
"title": "Communication de Braun du 12 juin 2020",
"url": "https://www.bbraunusa.com/content/dam/b-braun/us/website/customer_communications/Skyline%20Response_Outlook_6.9.2020_FINAL1.pdf"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11906",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11906"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11904",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11904"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 HP HPSBPI03666 du 12 juin 2020",
"url": "https://support.hp.com/in-en/document/c06640149"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-treck-ip-stack-JyBQ5GyC du 17 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11914",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11914"
},
{
"title": "Billet de blogue Ripple20 du 16 juin 2020",
"url": "https://www.jsof-tech.com/ripple20/"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11898",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11898"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11912",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11912"
},
{
"title": "Avis de s\u00e9curit\u00e9 du CERT Carnegie Mellon du 16 juin 2020",
"url": "https://kb.cert.org/vuls/id/257161"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11900",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11900"
},
{
"title": "Avis de s\u00e9curit\u00e9 ICS-CERT ICSA-20-168-01 du 16 juin 2020",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-168-01"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11909",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11909"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11901",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11901"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11913",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11913"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11896",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11896"
},
{
"title": "R\u00e9f\u00e9rence CVE CVE-2020-11899",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11899"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Schneider SEVD-2020-168-01 du 22 juin 2020, mis \u00e0 jour le 23 juin 2020",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SESB-2020-168-01_Treck_Vulnerabilities_Security_Bulletin.pdf\u0026p_Doc_Ref=SESB-2020-168-01"
}
],
"reference": "CERTFR-2020-AVI-375",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-01-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Le 16 juin 2020, des chercheurs ont annonc\u00e9 la d\u00e9couverte de dix-neuf\nvuln\u00e9rabilit\u00e9s dans l\u0027impl\u00e9mentation de la pile TCP/IP de Treck.\n\nCe composant est utilis\u00e9 dans de nombreux syst\u00e8mes embarqu\u00e9s et objets\nconnect\u00e9s, dont certains \u00e9quipements m\u00e9dicaux et \u00e9quipements de contr\u00f4le\nindustriel. Les vuln\u00e9rabilit\u00e9s les plus critiques permettent une\nex\u00e9cution de code arbitraire \u00e0 distance.\n\nLorsque des vuln\u00e9rabilit\u00e9s sont d\u00e9couvertes dans un composant d\u0027aussi\nbas niveau, il est tr\u00e8s difficile de compiler une liste exhaustive de\nproduits vuln\u00e9rables. De plus, la simple pr\u00e9sence de ce composant dans\nun produit n\u0027implique pas forc\u00e9ment que celui-ci est vuln\u00e9rable, parce\nque la vuln\u00e9rabilit\u00e9 a d\u00e9j\u00e0 \u00e9t\u00e9 corrig\u00e9e ou encore parce que ce\ncomposant a \u00e9t\u00e9 modifi\u00e9 et que la vuln\u00e9rabilit\u00e9 n\u0027est pas forc\u00e9ment\natteignable.\n\nLe CERT Carneggie Mellon ainsi que les chercheurs ont propos\u00e9 sur leurs\nsites respectifs une liste de produits vuln\u00e9rables et certains \u00e9diteurs\nont d\u00e9j\u00e0 communiqu\u00e9 sur le statut de leurs produits (cf. section\nDocumentation).\n\nParmi les dix-neuf vuln\u00e9rabilit\u00e9s, les trois les plus critiques sont\nidentifi\u00e9es comme :\n\n- CVE-2020-11896 : des datagrammes UDP fragment\u00e9s sur plusieurs\n paquets IP peuvent permettre un ex\u00e9cution de code arbitraire \u00e0\n distance ou un d\u00e9ni de service \u00e0 distance sur des \u00e9quipements avec\n une fonction d\u0027IP Tunneling activ\u00e9e ;\n- CVE-2020-11897 : des paquets IPv6 mal form\u00e9s permettent une\n ex\u00e9cution de code arbitraire \u00e0 distance \\[1\\] ;\n- CVE-2020-11901 : une r\u00e9ponse DNS mal form\u00e9e permet une ex\u00e9cution de\n code arbitraire \u00e0 distance.\n\nSi ces vuln\u00e9rabilit\u00e9s sont jug\u00e9es critiques, leur impact est att\u00e9nu\u00e9 par\nles conditions d\u2019exploitabilit\u00e9.\n\nIl convient donc de v\u00e9rifier dans un premier temps si les \u00e9quipements en\nbordure de r\u00e9seau sont dans une configuration vuln\u00e9rable. Si c\u0027est le\ncas, il faut alors appliquer les mises \u00e0 jour si elles sont disponibles\nou mettre en \u0153uvre les mesures de contournement.\n\n\u003cstrong\u003e\\[mise \u00e0 jour du 26 octobre 2020\\]\u003c/strong\u003e Les avis de s\u00e9curit\u00e9 Schneider\nElectric SEVD-2020-174-01 et SEVD-2020-175-01 ont \u00e9t\u00e9 mis \u00e0 jour le 22\noctobre 2020 suite \u00e0 la d\u00e9couverte d\u0027impacts suppl\u00e9mentaires sur les\nproduits Schneider. Des correctifs sont en cours de d\u00e9veloppement,\ncertains ont d\u00e9j\u00e0 \u00e9t\u00e9 publi\u00e9s et des mesures de contournement sont\nidentifi\u00e9es et list\u00e9es dans les avis \u00e0 jour.\n\n\u00a0\n\n\\[1\\] cette vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans la version 5.0.1.35, sans\n\u00eatre accompagn\u00e9e d\u0027un avis de s\u00e9curit\u00e9 \u00e0 l\u0027\u00e9poque de sa mise \u00e0\ndisposition.\n",
"title": "[M\u00e0J] Multiples vuln\u00e9rabilit\u00e9s dans la pile TCP/IP de Treck",
"vendor_advisories": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…