Forescout Vedere Labs uses AI to find 99 flaws, 66 new, in ten legacy TCP/IP stacks used in OT, IoT and critical infrastructure
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:09; os links antigos trazem para cá.
Forescout Research's Vedere Labs used AI-assisted vulnerability analysis on legacy TCP/IP stacks and found 99 vulnerabilities across ten widely used stacks, 66 of them previously unknown (industrialcyber.co, 2026-11-13). The work cut research time from about nine months to 90 hours. More than half of the new flaws are rated high or critical. The stacks underpin products in operational technology (OT), IoT, medical devices and critical infrastructure, so the findings are a supply chain risk. Cybersecuritydive.com (2026-11-12) first covered the research more generally. It described AI finding widespread IoT vulnerabilities in critical infrastructure embedded software faster and more cheaply than human-led methods. The sources name neither the affected stacks nor any CVE identifiers, and neither reports exploitation in the wild.
Entenda a falha
A vulnerabilidade
Forescout Research's Vedere Labs reports 99 vulnerabilities across 10 widely used legacy TCP/IP stacks, 66 of them previously unknown. No CVEs are listed and the sources do not name the stacks. By type, memory corruption is 49% of the findings, integer errors 27%, input validation 16% and logic or control-flow bugs 8%. Of the new flaws, 52% are high or critical (47% high, 5% critical), mostly in core IP, TCP, UDP, ICMP and Ethernet handling. The articles give no attacker prerequisites, affected versions or fixed versions; of 54 flaws reported to vendors, only five are fixed so far.
Como funciona
The articles do not describe the flow of any single flaw. In general terms, the bugs sit in protocol parsing code: network packets reach the stack's core layers, which read length, size and field values from the packet and use them in buffer and arithmetic operations. The flaws appear where those values are not properly checked, so reads or writes go out of bounds or integer calculations wrap, truncate or overflow. Because the same stack is embedded in many products, every device using it inherits the faulty parsing.
Por que é vulnerável
The root causes named are memory-safety and arithmetic errors: out-of-bounds reads and writes, buffer overflows, integer underflow, overflow, truncation and sign errors, and missing checks on bounds and null termination. A smaller group are logic bugs such as infinite loops, null dereferences, PRNG issues and recursion. Forescout says its AI harness is good at memory-safety bugs in parsing code but misses design flaws such as ISN predictability, DNS cache poisoning and TCP state machine issues, because its static rules target generic code patterns. The articles do not say what the fixes change.
Como foi descoberta
Forescout Research's Vedere Labs built its own AI harness for embedded software, covering reverse engineering, security analysis and dynamic emulation, and ran off-the-shelf AI models against open-source code and proprietary binaries. The work, titled 'Finding Critical Infrastructure Bugs with Off-the-Shelf AI', took about 90 hours versus roughly nine months of manual work, and static analysis cost about $935 (about $2.58 per finding). It followed up on Project Memoria (started 2020), rediscovering 33 of 82 known flaws (40%) and finding 66 new ones, some as byproducts of reachability analysis. Forescout reported 54 to vendors and maintainers (20 open-source, 34 proprietary), believing they still affect the latest versions; only five are fixed. Neither source reports exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:24.
Detalhes técnicos
- The new flaws are mainly memory corruption, integer errors and input validation issues (industrialcyber.co).
- The affected stacks are embedded in many vendors' products, so one flaw can reach many devices (industrialcyber.co).
- Legacy devices are often unsupported and hard to patch, so vulnerabilities can stay unmitigated for years (industrialcyber.co).
- Cybersecuritydive.com says the persistent weaknesses in critical infrastructure embedded software could be exploited if not addressed promptly. It also says AI-assisted assessment is faster and cheaper than traditional human-led research.
Remediação
Forescout's guidance, as reported by industrialcyber.co:
- Prioritize vulnerabilities by exploitability and operational impact.
- Minimize device exposure.
- Isolate devices that cannot be patched.
- Accelerate patch deployment.
- Build security requirements into procurement.
- Vendors should integrate AI-assisted testing into their development pipelines to detect vulnerabilities proactively.
Cybersecuritydive.com adds a call for more attention to AI-assisted security assessments and better defenses for IoT components in critical systems.
Linha do tempo
-
AI-assisted research uncovers 66 new vulnerabilities in legacy TCP/IP stacks affecting critical infrastructure and OT devices
ler a análise desta fonte ocultar
Forescout Research's Vedere Labs applied AI-assisted vulnerability analysis to legacy TCP/IP stacks, reducing research time from nine months to 90 hours and uncovering 99 vulnerabilities across ten widely used stacks, including 66 previously unknown flaws. Over half of the new vulnerabilities are high or critical severity, primarily involving memory corruption, integer errors, and input validation issues. These stacks underpin products across operational technology (OT), IoT, medical devices, and critical infrastructure, making widespread exploitation a significant supply chain risk. Legacy devices, often unsupported and hard to patch, pose heightened risks as vulnerabilities remain unmitigated for years. Forescout urges prioritizing vulnerabilities by exploitability and operational impact, minimizing device exposure, isolating unpatchable devices, accelerating patch deployment, and incorporating security requirements into procurement. Vendors are encouraged to integrate AI-assisted testing in development pipelines for proactive vulnerability detection. This research exemplifies AI's impact on accelerating and lowering costs of vulnerability discovery, underscoring a pressing need for improved risk management and patching strategies in critical sectors.
-
cybersecuritydive.com ↗ · pub. 12/11/2026 12:30 · coletado 12/11 13:02 primeiro registro só resumo do feed
AI accelerates discovery of widespread IoT vulnerabilities in critical infrastructure embedded software
ler a análise desta fonte ocultar
A recent report highlights how artificial intelligence (AI) has been leveraged to identify widespread vulnerabilities within IoT devices embedded in critical infrastructure software. This demonstrates the increasing effectiveness of AI in accelerating vulnerability research, uncovering potential security flaws more quickly and cost-effectively than traditional human-led methods. The findings underscore persistent weaknesses in critical infrastructure's embedded software that could be exploited if not addressed promptly. This development calls for heightened attention to AI-assisted security assessments and improved defenses for IoT components in critical systems.