The Treck/Kasago network stack appears to be running on the remote host.

Note that this plugin is based on detection methods provided by JSOF (https://www.jsof-tech.com/).

This plugin uses additional methods to detect the Treck/Kasago TCP/IP stack. These methods are known to have false positives. Every trigger of the plugin needs to be investigated manually for confirmation.

This plugin leverages one of the Ripple20 vulnerabilities (CVE-2020-11909) to determine if the Treck or Kasago TCP/IP stack is running on the remote host. It can be used for discovery of hosts in the environment that utilize the Treck or Kasago TCP/IP stack.
The plugin cannot determine if the patch for Ripple20 vulnerabilities was applied on the host.

Note that this plugin is based on a script provided by JSOF (https://www.jsof-tech.com/).

This plugin sends malformed packets to the remote host and looks for a response that could indicate a Treck/Kasago TCP/IP stack. 

If the remote host fails to respond, the plugin cannot make a determination. 

It's possible that a middle device (i.e., firewall or router) between Nessus and the target detects the malformed packets and does not forward them to the target. In this case, this plugin may not able to detect the Treck/Kasago TCP/IP stack or may produce incorrect results.

For the plugin to function effectively and not be impacted by intermediate devices on the network, the hosts being scanned should be on the same network segment as the scanner.

The Treck/Kasago network stack appears to be running on the remote  host.

Note that this plugin is based on a detection method provided by JSOF (https://www.jsof-tech.com/).

The plugin sends a special packet to the host and looks for a specific type of ICMP response packet. If the response is not received (for example, the host does not respond to the special packet or the response is blocked by a device between the scanner and the host), the plugin cannot make a determination. Failure to receive the specific type of ICMP packet in the response does not necessarily indicate that the remote host does not use the Treck/Kasago network stack.

The version of ArubaOS-Switch installed on the remote host is affected by multiple vulnerabilities in the Treck IP stack implementation. The vulnerabilities are collectively known as Ripple20, and can result in remote code execution, denial of service (DoS), and information disclosure by remote, unauthenticated attackers.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco ASR and Virtual Packet Core StarOS software is affected by multiple vulnerabilities in the Treck IP stack implementation. The vulnerabilities are collectively known as Ripple20, and can result in remote code execution, denial of service (DoS), and information disclosure by remote, unauthenticated attackers.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

This plugin detects the usage of the Treck TCP/IP stack by the host thereby indicating that it could be potentially vulnerable to the Ripple20 vulnerabilities. Patches are being slowly rolled out by vendors and we will release plugins for patches as they are released by the vendors. In the interim, if you have applied the patches from the vendor for the Ripple20 vulnerabilities on this host, please recast the severity of this plugin.

Note: This plugin requires ICMP traffic to be unblocked between the scanner and the host

ID	Name	Product	Family	Published	Updated	Severity
138614	Treck/Kasago Network Stack Detection	Nessus	Service detection	7/20/2020	2/12/2025	info
138615	Treck/Kasago Network Stack Detection With IP Option.	Nessus	Service detection	7/20/2020	2/12/2025	info
137703	Treck/Kasago Network Stack Detection	Nessus	Service detection	6/22/2020	2/12/2025	info
151188	ArubaOS-Switch Ripple20 Multiple Vulnerabilities (ARUBA-PSA-2020-006)	Nessus	Misc.	6/30/2021	4/25/2023	critical
139545	Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products: June 2020 (cisco-sa-treck-ip-stack-JyBQ5GyC)	Nessus	CISCO	8/12/2020	4/25/2023	critical
137702	Treck TCP/IP stack multiple vulnerabilities. (Ripple20)	Nessus	Misc.	6/22/2020	10/4/2023	critical

Detections

Analytics

Plugins Search

info

info

info

critical

critical

critical