Skip to content
OpenAdvisories
Unscored 1 exploited CVE SEVD-2020-175-01 19 CVEs

Treck TCP/IP Vulnerabilities (Ripple20)

Published Jun 23, 2020 · Updated Aug 8, 2022 · Revision 24

Vendor: Schneider Electric Product: ACE850 Sepam communication interface Product: Acti9 PowerTag Link / HD Product: Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D) Product: Acti9 Smartlink EL B A9XELC08 Product: Acti9 Smartlink IP Product: Acti9 Smartlink SI B Product: Acti9 Smartlink SI D Product: Andover Continuum controller models Product: ATV340E Altivar Machine Drives Product: ATV6000 Medium Voltage Altivar Process Drives Product: ATV630/650/660/680/6A0/6B0 Altivar Process Drives Product: ATV930/950/960/980/9A0/9B0 Altivar Process Drives Product: EcoStruxure Building SmartX IP MP Controllers Product: EcoStruxure Building SmartX IP RP Controllers Product: EGX150/Link150 Ethernet Gateway Product: eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers Product: Gateway Connector by Elko (EKO01827) Product: IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers Product: IFE Gateway Product: PowerLogic EGX100 Ethernet Gateway Product: PowerLogic EGX300 Ethernet Gateway Product: PowerLogic PM5000 series power meters Product: SCADAPack 32 RTU Product: TeSys T LTMRxxEyy Motor Controllers Product: TM3BC bus coupler module - CANOpen Product: TM3BC bus coupler module - SL Product: TM3BC bus coupler module – EIP Product: VW3A3310 Altivar 61/71 Modbus TCP option Product: VW3A3310D Altivar 61/71 Ethernet daisy chain option +8 more

Summary

Schneider Electric is aware of multiple vulnerabilities affecting Treck Inc.’s embedded TCP/IP stack, collectively known as Ripple20, which Treck disclosed publicly on June 16. The vulnerabilities range in severity and therefore have varying levels of risk.
Schneider Electric continues to assess how the newly disclosed vulnerabilities affect its offers. The company will continue to update this notification as additional offer-specific information becomes available.
Customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities. Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the remediation and general security recommendations below.
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
August 2022 Update: Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2).

Vulnerabilities 19

  • Medium 5.4
    CVE-2020-11899 Exploited EPSS 18%

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2020-11910 EPSS 11%

    The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.

  • Critical 9.1
    CVE-2020-11909

    The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.

  • Unscored —
    CVE-2020-11896 Public exploit EPSS 37%

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

  • Unscored —
    CVE-2020-11897

    The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.

  • Unscored —
    CVE-2020-11898 Public exploit EPSS 19%

    The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might al…

  • Unscored —
    CVE-2020-11900 EPSS 13%

    The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.

  • Unscored —
    CVE-2020-11901 EPSS 22%

    The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

  • Unscored —
    CVE-2020-11902

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.

  • Unscored —
    CVE-2020-11903

    The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.

  • Unscored —
    CVE-2020-11904

    The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Wr…

  • Unscored —
    CVE-2020-11905

    The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.

  • Unscored —
    CVE-2020-11906

    The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.

  • Unscored —
    CVE-2020-11907

    The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.

  • Unscored —
    CVE-2020-11908

    The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.

  • Unscored —
    CVE-2020-11911

    The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.

  • Unscored —
    CVE-2020-11912

    The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.

  • Unscored —
    CVE-2020-11913

    The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.

  • Unscored —
    CVE-2020-11914

    The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.

Revision history

  1. #2.18.0

    Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2)

  2. #2.17.0

    Added final mitigations for Andover Continuum Controllers (page 6)

  3. #2.16.0

    Added remediation for Wiser Energy IP module by Schneider Electric (EER31800), Wiser Energy IP module by Clipsal (EER72600), and Gateway Connector by Elko (EKO01827) (page 6-7)

  4. #2.15.0

    Added remediation for TeSys T LTMRxxEyy Motor Controllers (page 8)

  5. #2.14.0

    Corrected download links for TM3 bus coupler modules – EIP/SL/CANOpen (page 2-3)

  6. #2.13.0

    Added remediation for TM3 bus coupler modules – EIP/SL/CANOpen and Acti9 Smartlink EL B A9XELC08 (page 2-3, 5)

  7. #2.12.0

    Added remediation for ZBRCETH Modbus TCP communication module for ZBRN1 Harmony Hub (page 4)

  8. #2.11.0

    Added remediation for Acti9 PowerTag Link C (page 5)

  9. #2.10.0

    Fixed version for EcoStruxure Building SmartX IP MP Controllers and EcoStruxure Building SmartX IP RP Controllers corrected to 3.02.02 (previously listed as 3.02.01) (page 6)

  10. #2.9.0

    Added remediations for PowerLogic PM5000 Series Power Meters in Download Links section (page 11)

  11. #2.7.0

    Added remediations for SCADAPack 32 RTU, XUPH001 OsSense communication module, XGCS850C201 OsiSense RFID compact smart antenna, ATV340E Altivar Machine Drives, ATV630/650/660/680/6A0/6B0 Altivar Process Drives, ATV930/950/960/980/9A0/9B0 Altivar Process Drives, VW3A3720, VW3A3721 Altivar Process Communication Modules, ACE850 Sepam communication interface, PowerLogic EGX300 Ethernet Gateway, PowerLogic EGX100 Ethernet Gateway, Acti9 Smartlink IP (page 2, 4-5)

  12. #2.8.0

    Added remediations for EcoStruxure Building SmartX IP RP

  13. #2.6.0

    Added remediations for eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers, IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers, and IFE Gateway (page 4)

  14. #2.5.0

    - Added remediation for EGX150/Link150 Ethernet Gateway , Acti9 PowerTag Link / HD , Acti9 Smartlink SI D , and Acti9 Smartlink SI B - All APC Network Management Card related impact and remediation information has been moved to the existing Security Notification SEVD-2020-174-01 for increased clarity. - Added PowerLogic EGX100 to affected products list • Note: Based on information received earlier this year, Schneider Electric originally determined that its PowerLogic EGX100 was not affected by vulnerabilities in Treck Inc.’s embedded TCP/IP stack. After receiving additional information and analysis from Treck, Inc and JSOF, Schneider Electric has determined this offer is impacted. Users of this product are encouraged to apply the recommended mitigation actions immediately to minimize the risks associated with vulnerabilities in Treck Inc.’s embedded TCP/IP stack.

  15. #2.4.0

    Added remediation guidance for VW3A3310 Altivar 61/71 Modbus TCP, VW3A3310D Altivar 61/71 Ethernet daisy chain, VW3A3316 Altivar 61/71 Ethernet IP, and VW3A3320 Altivar 61/71 Ethernet IP RSTP options. (page 2-3)

  16. #2.3.0

    Added remediation for Cooling Products using NMC2 and partial remediations for ATM3BC bus coupler module – EIP, TM3BC bus coupler module – SL, and TM3BC bus coupler module – CANOpen (page 2-3)

  17. #2.2.0

    Corrected affected version(s) and enhanced remediation/mitigation version details for Uninterruptible Power Supply (UPS) using NMC2 (page 2)

  18. #2.1.0

    Added remediation for Uninterruptible Power Supply (UPS) using NMC2 (page 2)

  19. #2.0.0

    - Added Wiser Energy IP module by Schneider Electric, Wiser Energy IP module by Schneider Electric , and Gateway Connector by Elko to affected products list (page 5) - Added XUPH001 OsSense communication module and XGCS850C201 OsiSense RFID compact smart antenna to affected products list (page 2) - Removed PowerLogic EGX100, ECI850 Sepam IEC 61850 Server, and PowerLogic G3200 Modbus to IEC 61850 Gateway from affected products list. (page 3)

  20. #1.4.0

    Removed Smartlink ELEC (duplicate reference for Acti9 Smartlink EL B) from the affected product list (page 3)

  21. #1.3.0

    Added Acti9 Smartlink EL B to affected product list (page 2)

  22. #1.2.0

    - Enhanced Andover Continuum affected product information (page 3) - Minor formatting changes

  23. #1.1.0

    - Added link to related SEVD-2020-174-01 Security Notification document for Network Management Card (NMC) offers (pages 4-5) - Minor formatting changes

  24. #1.0.0

    Original Release

References