Vulnerability

BD finds Ripple20 Treck TCP/IP stack in Kiestra and Rowa components

MedDevice Cyber Staff · Jul 30 · 3 min read · Via BD bulletin: Third-Party Product Security Bulletin for Treck TCP/IP Stack Vulnerabilities

BD published a third-party bulletin on July 30, 2020 on the Treck TCP/IP stack vulnerabilities known as Ripple20. BD assessed CVE-2020-11896 through CVE-2020-11907 and found they could affect third-party components in certain products.

The products named are BD Kiestra TLA, WCA and ReadA standalone with SCU, BD Rowa conveyor technology and the BD Rowa label printer. BD has not received reports of exploitation on BD products.

Treck is a small embedded network stack licensed into equipment from many makers. The flaws reach devices through components like controllers and printers that nobody inventories as software.

Ripple20 is the case for component-level SBOMs. If the label printer runs its own network stack, it belongs on the list.

Are you a representative of BD? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

BD assessed the Ripple20 CVEs against Kiestra and Rowa products in its July 30, 2020 bulletin. Labs and pharmacies should get BD's component-level remediation status for each listed product. Keep the affected equipment on segments with no route from general IT.

Get component status from BD. Ask BD which Kiestra and Rowa components embed Treck and when updated firmware ships.
Segment automation equipment. Place Kiestra lines and Rowa conveyors and printers on isolated segments.
Inventory embedded stacks. Record third-party network stacks in controllers and printers in the product SBOM.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Off-the-shelf software

BD Kiestra TLA, WCA and ReadA with SCU

Off-the-shelf software

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

Which BD products are affected by Ripple20?

BD's July 30, 2020 bulletin says Ripple20 Treck TCP/IP stack vulnerabilities could affect third-party components in BD Kiestra TLA with SCU, Kiestra WCA with SCU, Kiestra ReadA standalone with SCU, BD Rowa conveyor technology and the BD Rowa label printer.

What CVEs did BD assess for the Treck TCP/IP stack?

BD's July 30, 2020 bulletin covers the Ripple20 Treck TCP/IP stack CVEs CVE-2020-11896 through CVE-2020-11907 and reports no exploitation on BD products.

← Back to Vulnerabilities