CVE-2020-11899: Treck TCP/IP stack Out-of-Bounds Read Vulnerability
CVSS: 5.4v3.1MediumKEVAnalyzed
Published 17-06-2020Last modified 21-10-2025
Vulnerability summary
CVE-2020-11899 is a medium (CVSS 5.4) Out-of-bounds Read vulnerability in Treck TCP/IP stack IPv6. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 18.42% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)EPSS score
18.42%
0%100%
Medium · -0.14 pp in 30 daysKEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 17-06-2020PublishedVulnerability first disclosed.
- 03-03-2022Added to CISA KEVTreck TCP/IP stack Out-of-Bounds Read Vulnerability
- 17-03-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LSourcesAll 2 agree
- NVDNIST5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Medium 4.8Preferred score · NVD (NIST)
AV:A/AC:L/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
18.42%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-0.14 pp
From 18.56% on 18-09-2026
18-09-202618-10-2026
EPSS score18.42%
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2022
- Federal due date
- 17-03-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-11899
Public exploits
1 foundExploit Reference (jsof-tech.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Dell3 products
Treck1 product
- tcp\/ip< 6.0.1.66
2 vendors · 4 products
References
12 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.htmlX Refsource CONFIRMThird Party Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyCVendor AdvisoryX Refsource CISCOThird Party Advisory
- www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txtX Refsource CONFIRMBroken LinkThird Party Advisory
Show all 12 references
- www.dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilitiesX Refsource MISCThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899Government ResourceUS Government Resource