IoT Ripples and Crumbles … Again

Just when it seems that IoT security could not get any lower, the Department of Homeland Security and CISA ICS-CERT has issued 19 vulnerabilities affecting more than 500 vendors and which will have a significant effect on billions of devices. These vulnerabilities have been defined as Ripple20 and where found by JSOF (and Isralli cybersecurity company). The name Ripple20 comes from the year (2020) and the ripple effect from a single company.

JSOF found the vulnerbility when they recently tested a device, and found some major vulnerabilities, and then traced it to software written by Trek. Trek is company who focus on createing the network stack for many IoT products. Of the vulnerabilties found, JSOF found that some of them allowed for remote access to a device, and without any user interaction [here]:

Five of the vulnerabilities gain a CVSS of 9 and above:

• CVE-2020–11896 (CVSS v3 base score 10.0): This involves incorrect handling of the length of a UDP packet, and allowing for remote code execution.
• CVE-2020–11897 (CVSS v3 base score 10.0): This involves incorrect handling of IPv6 packets, and can creates an out-of-bounds write.