CVE-2020-11899
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- Record
CVE-2020-11899- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 4.8 Medium
AV:A/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- Record
CVE-2020-11899- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2020-4236
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- Record
EUVD-2020-4236- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6r3w-c7h6-wfhg
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
- Record
GHSA-6r3w-c7h6-wfhg- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
CISA KEV No score
Treck TCP/IP stack Out-of-Bounds Read Vulnerability
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
- Record
CVE-2020-11899- Weakness
- CWE-125
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11899 is a medium vulnerability (CVSS 5.4) in Treck Tcp/ip Stack Ipv6, published June 17, 2020. CISA lists it as known to be exploited, since March 3, 2022. EUVD reports exploitation since March 3, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. No source names a fixed version.
References
cwe.mitre.org/data/definitions/125.html
kb.cert.org/vuls/id/257161
treck.com
jsof-tech.com/vulnerability-disclosure-policy
intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html
jsof-tech.com/ripple20
Show 7 moreShow less
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC
arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt
security.netapp.com/advisory/ntap-20200625-0006
dell.com/support/article/de-de/sln321836/dell-response-to-the-ripple20-vulnerabilities
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11899
nvd.nist.gov/vuln/detail/CVE-2020-11899
github.com/advisories/GHSA-6r3w-c7h6-wfhg