Armis researchers found that around 200 million devices – some of which could be controlling important equipment such as elevators and medical equipment – are vulnerable to a remote takeover attack which gives the malicious party complete control over the device.
The researchers outlined 11 different vulnerabilities in various iterations of VxWorks, which is a lightweight operating system used in over two billion devices worldwide.
The 11 vulnerabilities, called “Urgent 11” by Armis, include six remote code flaws as well as five lesser issues which still leave systems open to DDOS attacks and data leaks.
Many of the vulnerabilities are found within IPnet – a networking stack – and allow malicious parties to easily avoid firewalls and other security measures.
“Such vulnerabilities do not require any adaptations for the various devices using the network stack, making them exceptionally easy to spread,” the researchers said.
In response, Arlen Baker – chief security architect at VxWorks’ developer Wind River – said the company has worked with Armis to ensure customers were notified, and that relevant patches and mitigation options were provided.
Baker added that the exploits only affect connected devices that are running older versions of VxWorks.
“The latest release of VxWorks is not affected by the Urgent/11 vulnerability, nor are any of Wind River’s safety-critical products that are designed for safety certification, such as VxWorks 653 and VxWorks Cert Edition used in critical infrastructure.”