Understanding Operational Technology Attacks: A Journey Through the Past, Present, and Future

Serious Vulnerabilities Discovered in Treck TCP/IP Stack Impacting Millions of IoT Devices

The US Cybersecurity Infrastructure and Security Agency (CISA) has issued a warning regarding significant vulnerabilities in a low-level TCP/IP software library created by Treck. If exploited, these vulnerabilities could enable remote attackers to execute arbitrary commands and conduct denial-of-service (DoS) attacks. The identified flaws affect Treck TCP/IP stack version 6.0.1.67 and earlier, and were reported to Treck by Intel. Among these, two are classified as critical. Treck’s embedded TCP/IP stack is widely utilized across various sectors, including manufacturing, information technology, healthcare, and transportation.

The most critical vulnerability is a heap-based buffer overflow (CVE-2020-25066) found in the Treck HTTP Server component, which may allow an attacker to crash or reset the target device and potentially execute remote code, receiving a CVSS score of 9.8 out of 10. The second flaw, an out-of-bounds write within the IPv6 component (CVE-2020-27337), also poses a significant threat with a CVSS score of 9.1.