CVE-2020-11911

Vulnerability

The Treck TCP/IP stack before version 6.0.1.66 contains an improper ICMPv4 access control vulnerability (CVE-2020-11911). This issue arises due to insufficient validation of ICMPv4 packets, allowing an attacker to bypass intended access restrictions. The vulnerability is present in the Treck IP stack, which is widely used in embedded systems, including those from vendors such as Dell and Cisco [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted ICMPv4 packets to a vulnerable device. No authentication is required, and the attacker only needs network access to the target. The attack can be performed remotely over the network without user interaction [1].

Impact

Successful exploitation could lead to denial of service, information disclosure, or arbitrary code execution. The exact impact depends on the specific implementation and configuration of the Treck stack in the affected device. In many cases, a remote unauthenticated attacker could gain full control of the device [1][4].

Mitigation

Treck has released version 6.0.1.67 to address this vulnerability. Users should update to the latest stable version. Additional mitigations include blocking anomalous IP traffic via deep packet inspection and ensuring that firewalls drop malformed packets. Vendors such as Dell and Cisco have provided updates for their affected products [1][3][4].