CVE-2020-11901: treck tcp\/ip Out-of-bounds Read

Vulnerability summary

CVE-2020-11901 is a high (CVSS 9.3) Out-of-bounds Read vulnerability in treck tcp\/ip. EPSS estimates a 21.12% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-06-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.