As of June 16, 2020, a total of 19 vulnerabilities, collectively called Ripple20, were found within an embedded TCP/IP stack software library. This library, developed by Treck, Inc. was used in the manufacturing chain across all industries and could affect several hundred million connected devices. There are at least 21 confirmed affected vendors including Aruba Networks, Cisco, Dell, Digi International, HP, Intel, as well as several OT device manufacturers, such as Rockwell Automation and Schneider Electric/APC.

Four vulnerabilities are considered critical and are tracked against CVE-2020-11896, CVE-2020-11897, CVE-2020-11898 and CVE-2020-11901. These four have a CVSS severity score greater than 9 and can lead to remote code execution if weaponized. It is recommended affected devices are updated to the latest Treck stack version 6.0.1.67 or greater.

Subscribe
Notify of
guest

1 Expert Comment
Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Mike Cotton
Mike Cotton , SVP of engineering
InfoSec Expert
July 3, 2020 4:43 pm

With a lack of standardization and security requirements across IoT developers and manufacturers, vulnerability disclosures, like the Ripple20 collection, pose a serious threat to networks with increased IoT adoption and deployments if not properly segmented.

Last edited 2 years ago by Mike Cotton
Information Security Buzz
1
0
Would love your thoughts, please comment.x
()
x