Vulnerability record · CVE-2020-11899 · published 17 June 2020
CVE-2020-11899: Treck TCP/IP stack IPv6 out-of-bounds read (Ripple20)
Treck · Tcp\/Ip
The Treck TCP/IP stack before 6.0.1.66 contains an out-of-bounds read in its IPv6 handling (CWE-125). Because Treck is embedded in many OEM products, the same flaw can appear across a wide range of devices, including Dell Wyse thin clients listed here. The record does not describe the exact packet or code path that triggers the read.
Description
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Automated analysis
high priorityIt is in CISA KEV with a high EPSS percentile and affects widely embedded networking code, though the CVSS impact is only medium and the record lacks exploit detail.
What it is
The Treck TCP/IP stack before 6.0.1.66 contains an out-of-bounds read in its IPv6 handling (CWE-125). Because Treck is embedded in many OEM products, the same flaw can appear across a wide range of devices, including Dell Wyse thin clients listed here. The record does not describe the exact packet or code path that triggers the read.
Impact
An attacker on the adjacent network can trigger an out-of-bounds read, which the CVSS vector scores as low integrity and availability impact with no confidentiality impact. The record does not state whether the read can be turned into code execution or a crash.
Attack surface
Reached over the adjacent network via IPv6 traffic, per the CVSS vector AV:A/PR:N/UI:N, so no authentication or user interaction is required. The description does not specify which IPv6 message or field is malformed.
Exploitation
CVE-2020-11899 is listed in CISA KEV (added 2022-03-03, due 2022-03-17) and has an EPSS 30-day probability of 0.186 (97th percentile). A reference is tagged Exploit, but the record does not confirm public exploit code or in-the-wild use beyond the KEV listing.
What to do
- Apply the Treck TCP/IP stack update to 6.0.1.66 or later, or the OEM firmware update from your device vendor (Dell, Cisco, Aruba, Intel, NetApp advisories are referenced).
- Inventory embedded devices using the Treck stack, including Dell Wyse 5030, 5050 and 7030 thin clients, and track vendor patch status.
- Where patching is not possible, restrict IPv6 exposure on adjacent network segments and disable IPv6 on devices that do not need it.
- Monitor CERT/CC VU#257161 and vendor advisories for updated guidance and affected product lists.
Detection
- Monitor for crashes or abnormal resets of embedded devices that handle IPv6 traffic on adjacent network segments.
- Watch network traffic for malformed or unusual IPv6 packets reaching Treck-based devices, if IPv6 inspection is available.
- Track device firmware versions against the fixed 6.0.1.66 baseline and flag unpatched units.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-11899 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Treck TCP/IP stack Out-of-Bounds Read Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 March 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-11899 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-11899), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
