CVE-2020-11896

CRITICAL

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Affects 6 products across 3 vendors.

CVSS 3.110.0
EPSS36.9%
Percentile98th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-119: Improper Restriction of Operations within Memory Buffer

Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-119
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-119
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-119
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-119
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-119
Show all 12

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The Treck TCP/IP stack before 6.0.1.66 is vulnerable to Remote Code Execution due to an issue in IPv4 tunneling. This vulnerability has a CVSS score of 10.0, indicating critical severity. Affected vendors include Fujitsu-Siemens, Schneider-Electric, Siemens, Treck, and Wolfram Schneider. A public proof of concept exists, but no known exploits are currently available.

BSID: BS-2020-GLOBAL-234007-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-11896?
The Treck TCP/IP stack before 6.0.1.66 is vulnerable to Remote Code Execution due to an issue in IPv4 tunneling. This vulnerability has a CVSS score of 10.0, indicating critical severity. Affected vendors include Fujitsu-Siemens, Schneider-Electric, Siemens, Treck, and Wolfram Schneider. A public proof of concept exists, but no known exploits are currently available.
What is the CVSS score for CVE-2020-11896?
CVE-2020-11896 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 36.9%.
Is CVE-2020-11896 actively exploited?
No confirmed active exploitation of CVE-2020-11896 as of 2026-09-25.
How do I remediate CVE-2020-11896?
Priority: IMMEDIATE. Advisory: https://www.treck.com PSIRT: [email protected]
What systems are affected by CVE-2020-11896?
CVE-2020-11896 affects Schneider-Electric Acti9 Powertag Link, Acti9 Powertag Link Hd, EGX150/Link150 Ethernet Gateway; Siemens; Treck Tcp/Ip.
What NERC-CIP standard applies to CVE-2020-11896?
NERC CIP CIP-007 CIP-007-R2: This CVE violates CIP-007-R2 because it allows unauthorized access to electronic security perimeters, which could compromise the integrity and availability of critical assets.
What IEC 62443 requirement maps to CVE-2020-11896?
IEC 62443 SR 7.6: This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely, leading to loss of control over the affected system, which is a critical security concern in ICS environments.
Vulnerability Details
CVE IDCVE-2020-11896
BSIDBS-2020-GLOBAL-234007-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2020-06-17
Last Modified2026-06-17
ICS Relevance70%
Weakness (CWE)
Improper Restriction of Operations within Memory BufferOut-of-Bounds Write
Verticals
ICS-OT
SourceNVD
Official Description

The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper handling of IPv4 tunneling packets in the Treck TCP/IP stack. An attacker can send specially crafted packets to trigger remote code execution on the target system. This can lead to complete compromise of the affected device, potentially allowing the attacker to execute arbitrary code with full privileges.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Schneider-Electric Acti9 Powertag Link (device & firmware) < 001.008.007
Schneider-Electric Acti9 Powertag Link Hd (device & firmware) < 001.008.007
Schneider-Electric EGX150/Link150 Ethernet Gateway 5.1.18 ≤ 5.1.15
Siemens — —
Treck Tcp/Ip < 6.0.1.66
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2311 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
● Compensating Controls — AI-drafted, review before deploying MEDIUM CONFIDENCE

Implement network segmentation and apply strict firewall rules to limit access to the affected systems. Monitor network traffic for suspicious activity and apply the latest security patches as soon as they become available.

No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.

NERC CIP: CIP-007 CIP-007-R2
This CVE violates CIP-007-R2 because it allows unauthorized access to electronic security perimeters, which could compromise the integrity and availability of critical assets.
IEC 62443: SR 7.6
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited remotely, leading to loss of control over the affected system, which is a critical security concern in ICS environments.

Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.

AI Enrichment Record — provenance & audit hash
ModelQwen/Qwen2.5-72B-Instruct-AWQ
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashd06ba46fd05907895379e3103e7b097f678122fc2162bf1035dd0ee37222f3dd4b4751d3d0233d82594d7a91ad1776f7247263be51277707c709ce3c68e49308
Related CVEs affecting Schneider-Electric
CVE-2011-4861 10.0 The modbus_125_handler function in the Schneider Electric Quantum Ethernet Mo... CVE-2013-0658 10.0 Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accu... CVE-2020-1350 10.0 A remote code execution vulnerability exists in Windows Domain Name System se... CVE-2013-0657 10.0 Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA... CVE-2011-4859 10.0 The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE...
View all Schneider-Electric CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →