{"id":102115,"date":"2020-06-22T15:32:25","date_gmt":"2020-06-22T22:32:25","guid":{"rendered":"\/blogs\/?p=102115"},"modified":"2025-06-04T02:47:20","modified_gmt":"2025-06-04T09:47:20","slug":"ripple20-vulnerability-mitigation-best-practices","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/ripple20-vulnerability-mitigation-best-practices\/","title":{"rendered":"Ripple20 Vulnerability Mitigation Best Practices"},"content":{"rendered":"

On June 16th<\/sup>, the Department of Homeland Security and CISA ICS-CERT issued<\/a>\u00a0a critical security\u00a0advisory<\/a>\u00a0warning covering multiple newly discovered vulnerabilities affecting Internet-connected devices manufactured by multiple vendors. This set of 19 vulnerabilities in a low-level TCP\/IP software library developed by Treck has been dubbed \u201cRipple20\u201d by researchers from JSOF.<\/p>\n

A networking stack is a software component that provides network connectivity over the standard internet protocols. In this specific case these protocols include ARP, IP (versions 4 and 6), ICMPv4, UDP and TCP communications protocols, as well as the DNS and DHCP application protocols. The Treck networking stack is used across a broad range of industries (medical, government, academia, utilities, etc.), from a broad range of device manufacturers \u2013 a fact which enhances their impact and scope, as each manufacturer needs to push an update for their devices independently of all others. In other words, the impact ripples out across the industry due to complexities in the supply and design chains.<\/p>\n

Identifying vulnerable devices on your network is a crucial step in assessing the risk of Ripple20 to your organization. While a simple Shodan search for \u201ctreck\u201d<\/a> shows approximately 1000 devices, which are highly likely to be internet-facing vulnerable devices, this represents only a fraction of the impacted devices. Identification of the Treck networking stack vs. other networking stacks (such as the native Linux or Windows stacks) requires detailed analysis and fingerprinting techniques based on the results of network scans of the devices in question.<\/p>\n

The impact of these vulnerabilities ranges from denial of service to full remote code exploitation over the internet, with at least one case not requiring any authentication (CVE-2020-11901<\/a>). JSOF researchers identified that these vulnerabilities impact a combination of traditional and IoT devices. Customers should review advisories from vendors such as Intel<\/a> and HP because non-IoT devices may be running firmware that makes use of the Treck networking stack.<\/p>\n

Ripple20\u2019s most significant impact is to devices whose network stack is exposed (in general IoT devices incorporating the Treck network stack) as compared to devices that incorporate the stack that it is only exposed to the local device. We recommend that you audit all network-enabled devices to determine if they are susceptible to these vulnerabilities.<\/p>\n

There are potentially tens of millions of devices that are vulnerable to at least one of the Ripple20 flaws. Mitigating impact requires attention from both device owners and device vendors.<\/p>\n

Mitigations for users of vulnerable devices per CISA recommendations (where possible):\u00a0<\/strong><\/h2>\n