A set of previously unknown vulnerabilities on the Treck IP stack implementation were disclosed on June 16, 2020. The vulnerabilities are collectively known as Ripple20. Exploitation of these vulnerabilities could result in remote code execution, denial of service (DoS), or information disclosure, depending on the specific vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC"]

The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

Improper handling of length parameter inconsistency in IPv4/UDP component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution. Improper handling of length parameter inconsistency in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in possible out-of-bounds write. Improper handling of length parameter inconsistency in IPv4/ICMPv4 component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in out-of-bounds read. Improper input validation in IPv6 component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read and a possible denial of service. Possible double free in IPv4 tunneling component when handling a packet sent by a network attacker. This vulnerability may result in use after free. Improper input validation in DNS resolver component when handling a packet sent by an unauthorized network attacker. This vulnerability may result in remote code execution. Improper input validation in IPv6 over IPv4 tunneling component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow out-of-bounds read. Possible out-of-bounds read in DHCP component when handling a packet sent by an unauthorized network attacker. This vulnerability may allow exposure of sensitive information. Possible integer overflow or wraparound in me…

Schneider Electric became aware of multiple vulnerabilities affecting Treck Inc.'s embedded TCP/IP stack, collectively known as Ripple20, which Treck publicly disclosed on June 16, 2020. Schneider Electric is also aware of a proof of concept published by JSOF that demonstrates how one of the Treck vulnerabilities, CVE-2020-11901, can be exploited to affect a Schneider Electric APC SmartUPS device using certain Network Management Card firmware versions. On October 12, 2020, Schneider Electric received additional information and analysis from JSOF related to CVE-2020-11901’s impact on APC by Schneider Electric Network Management Cards and NMC embedded devices. This new analysis indicates that the information we originally received was incomplete. Therefore our original remediations are only partially effective for CVE-2020-11901. We are expediting updated remediations, which will be made available as soon as possible. In the meantime, customers should immediately apply the mitigations included in Remediation & Mitigations section of this document. June 2021 Update: Added remediations for Uninterruptible Power Supply (UPS), Rack Power Distribution Units (rPDU), Battery Management, Rack Automatic Transfer Switch (ATS), Rack Air Removal Unit (RARU) using NMC1, as well as all other remaining NMC1 applications.

For process data documentation purposes the laboratory washers, thermal disinfectors and washer-disinfectors can be integrated in a TCP/IP network by utilizing the affected communication module.

The communication module is separate from the actual device control and uses a chipset from Digi International.

The TCP / IP stack required for networking is implemented in this chipset with the help of a 3rd party library from Treck. External security researchers have identified several security holes in this library called Ripple20. The most critical vulnerability allows an external attacker to execute arbitrary code on the chip and thus also on the communication module.

The above named communication module can be integrated into the following laboratory washers, thermal disinfectors and washer- disinfectors:

- PG 8581 - PG 8582 - PG 8583 - PG 8583 CD - PG 8591 - PG 8582 CD - PG 8592 - PG 8593 - PG 8562

Critical vulnerabilities have been discovered in the utilized component TRECK TCP/IP Stack by Digi International Inc.

For more information see advisory by Digi International Inc.: Digi International Security Notice - TRECK TCP/IP Stack "RIPPLE20" VU#257161 ICS-VU-035787 | Digi International

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Produkten, die die Treck TCP/IP-Stack-Bibliothek verwenden, ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.