VDB
CVE-2020-11896
CVE-2020-11896
PUBLISHED
Es existieren mehrere Schwachstellen in Produkten, die eine TCP/IP-Stack-Bibliothek des Herstellers Treck verwenden. Die Schwachstellen werden gesammelt als "Ripple20" bezeichnet und betreffen Produkte aus verschiedensten Sektoren. Die Schwachstellen bestehen aufgrund einer fehlerhaften Behandlung von Inkonsistenzen bei Längenparametern, einer unsachgemäßen Eingabevalidierung, Double Free-Fehlern, Out-of-Bounds-Lese-Fehlern, Integer-Überlaufen oder Wraparounds, einer unsachgemäßen Null-Terminierung, sowie einer unsachgemäßen Zugriffskontrolle. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herzustellen.
EPSS 42.88% · 97.6th percentile
Risk Scores
EPSS Score
42.88%
97.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| HPE | HPE Integrated Lights-Out 3 | |
| Aruba | Aruba ArubaOS | |
| PaloAlto Networks | PaloAlto Networks PAN-OS | |
| HPE | HPE Integrated Lights-Out 5 | |
| Cisco | Cisco Router | |
| Intel | Intel BIOS | |
| HPE | HPE ProLiant | |
| Aruba | Aruba Switch | |
| Dell | Dell Computer | |
| Intel | Intel Server Firmware | |
| Eaton | Eaton UPS | |
| HP | HP LaserJet | |
| Xerox | Xerox FreeFlow Print Server |
Exploit Intelligence
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc-repo)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc)
- RCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210 (github-poc)
…and 18 more exploits
Timeline
- CVE Published
- Jun 22, 2020 PoC Published
- Apr 14, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 26, 2023 EPSS Score
- Jun 6, 2023 EPSS Score
- Oct 21, 2023 EPSS Score
- Nov 21, 2023 EPSS Score
- May 24, 2024 EPSS Score
- Dec 17, 2024 EPSS Score
- Mar 17, 2025 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-0683.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0683 advisory
- https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/ETN-SB-2020-1008.pdf advisory
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04103en_us advisory
- https://www.jsof-tech.com/ripple20/ advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html advisory
- https://support.hp.com/emea_africa-en/document/c06640149 advisory
- https://www.se.com/ww/en/download/document/SESB-2020-168-01/ advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-168-01 advisory
- https://www.kb.cert.org/vuls/id/257161 advisory
- https://security.business.xerox.com/wp-content/uploads/2020/06/cert_Security_Mini_Bulletin_XRX20J_for_B2XX.pdf advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC advisory
- https://www.dell.com/support/article/sln321836/dell-response-to-the-ripple20-vulnerabilities?lang=en advisory
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt advisory
- https://www.dell.com/support/article/sln321835/dsa-2020-150-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards?lang=en advisory
- https://security.paloaltonetworks.com/PAN-SA-2020-0007 advisory
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04012en_us advisory
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04021en_us advisory
- https://www.dell.com/support/kbdoc/de-de/000125440/dsa-2020-206-dell-client-platform-security-update-for-treck-tcp-ip-stack-vulnerabilities-in-teradici-firmware-and-remote-workstation-cards advisory