Ripple20 : The Set Of Vulnerabilities
In 2020 a small cybersecurity research company has found a set of 19 vulnerabilities that originated from the Treck Internet Protocol library. The vulnerabilities have affected different manufacturers as it was used in their components.
Ripple 20
JSOF has declared information on a group of vulnerabilities known as Ripple20. They have the potential to impact millions of IoT devices across different industries. Some of them are delicate machines in the medical, transportation, manufacturing industries, etc. These vulnerabilities were seen in an American software Treck Inc. This software uses a lightweight TCP/IP stack and allows companies to connect their devices or software to the internet via TCP/IP connections. The software has been used by different manufacturers and because of this, the impact was widespread.
Read More: What Happened in the Twitter Attack?
Problems of Ripple20
Ripple 20 led the hackers to access vulnerable devices through local networks or over the internet and can take control of devices. One of the vulnerabilities is a DNS protocol where a hacker can attack devices that are not connected to the internet. Other possible attacks defined by JSOF, include the use of vulnerable devices to target other devices in a network, utilizing the vulnerable device to act hidden in-network, and broadcasting an attack to take control of all infected devices in the network, etc..Four of the Ripple20 vulnerabilities are critical, with CVSS (common vulnerability scoring system) scores over 9 and enable Remote Code Execution. Treck has released a security update addressing these vulnerabilities.
Read More
Solutions against Ripple20
To avoid Ripple20 Vulnerabilities, detection is one of the major steps.
Products like EdgeIPSTM and EdgeFireTM can help owners find Ripple 20 vulnerabilities through network traffic scanning. Try to block abnormal IP traffic. The users take protective measures against these vulnerabilities by installing updates from Treck, minimizing network exposure, implementing firewalls, and using virtual private networks, and internal DNS servers.
Mobile Application Penetration Testing for Qatar Government Digital Services: NCSA- Aligned Security Assurance
Key Takeaways: Mobile Application Penetration Testing Qatar must cover the app, device storage, APIs, authentication and third-party components. Qatar’s NCSA assurance environment combines the National Information Assurance (NIA) Standard, the National Information Security Compliance Framework (NISCF) and accredited security assessment services. OWASP MASVS defines mobile security controls, while MASTG supplies practical test methods for Android […]
Qatar Data Protection Law: Implementing PDPPL Data Subject Rights Processes for Businesses
Key Takeaways: The Qatar Data Protection Law (Law No. 13 of 2016) for Personal Data Privacy Protection, grants individuals specific rights such as right to access, correct, erase, object, withdraw consent, and right to be notified of processing or inaccurate disclosure. Beyond having a privacy policy, businesses or controllers, under Article 11 of Personal Data […]
AI Governance for Indian Enterprises: Building Internal Controls Before Key DPDP Obligations Take Effect
Key Takeaways: The DPDP Act does not contain AI-specific provisions. Its requirements, however, apply in situations when an AI system processes digital personal data within its territorial and material scope. India is working on building a broader governance framework around safety, accountability, transparency and trust via programs like the IndiaAI Mission. Indian organizations should inventory […]
Cloud Security Audit for UAE Government Cloud Migration: NCAP and Security Requirements
Key Takeaways: A cloud security audit UAE helps government entities identify security, governance, configuration, access, data-protection and resilience gaps, before and after shifting critical workloads to the cloud. UAE National Cloud Security Policy has defined cloud governance, data security, data sovereignty, IAM, incident management, resilience, portability and cloud operations requirements. The National Cyber Accreditation Program […]
Data Privacy Consulting UAE – Building a PDPL-Compliant Data Governance Program
Key Takeaways: PDPL compliance requires ongoing operational governance that goes beyond policies to demonstrate how personal data is collected, used, protected, transferred, retained, and deleted. Data mapping helps businesses move from reactive compliance to proactive risk management by establishing a comprehensive inventory of the data ecosystem, helping build a mature data privacy and governance program. […]
Saudi Arabia’s Critical Systems Controls: What CSP-Linked Enterprises Must Comply With in 2026
Key Takeaways: The Critical Systems Cybersecurity Controls (CSCC) are more applicable to critical systems than to all IT assets owned or operated by an organization. To be in full compliance or to remain in full compliance with CSCC, organizations must maintain continuous adherence to NCA ECC. CSCC has 32 core controls and 73 sub-controls across […]
