AI-assisted research uncovers 66 new vulnerabilities in legacy TCP/IP stacks affecting critical infrastructure and OT devices

Entenda a falha

A vulnerabilidade

Forescout's Vedere Labs reports 99 vulnerabilities across 10 widely used legacy TCP/IP stacks, 66 of them previously unknown. No CVEs are listed for the story. Memory corruption is 49% of the findings, integer errors 27%, input validation flaws 16% and logic or control-flow bugs 8%. Of the new ones, 52% are high or critical (47% high, 5% critical), and most affect core IP, TCP, UDP, ICMP and Ethernet handling. The articles do not give attacker prerequisites, specific affected versions or fixed versions. Of 54 flaws reported to vendors and maintainers, only five have been fixed so far.

Como funciona

The articles do not describe the flow of any single flaw. In general terms, the bugs sit in protocol parsing code: network packets reach the stack's core layers, which read length, size and field values from the packet and use them for buffer and arithmetic operations. The flaws occur where those values are not properly checked, so reads or writes go out of bounds or integer calculations wrap, truncate or overflow. Because the same stack is embedded in many products, the faulty parsing is inherited by every device that uses it.

Por que é vulnerável

The root causes named are memory-safety and arithmetic errors: out-of-bounds reads and writes, buffer overflows, integer underflow, overflow, truncation and sign errors, and missing checks on bounds and null termination. A smaller group are logic bugs such as infinite loops, null dereferences, PRNG weaknesses and recursion. Forescout says its AI harness is good at memory-safety bugs in parsing code but misses design flaws such as ISN predictability, DNS cache poisoning and TCP state machine issues, since its static rules target generic code patterns. The articles do not say what the fixes change.

Como foi descoberta

Forescout Research's Vedere Labs built its own AI harness for embedded software, covering reverse engineering, security analysis and dynamic emulation, and ran off-the-shelf AI models against open-source code and proprietary binaries. The work, titled 'Finding Critical Infrastructure Bugs with Off-the-Shelf AI', took about 90 hours versus roughly nine months of manual work, and the static analysis cost about $935 (about $2.58 per finding). It followed up on Project Memoria (started 2020), rediscovering 33 of 82 known flaws (40%) and finding 66 new ones, some of them byproducts of reachability analysis. Forescout reported 54 to vendors and maintainers (20 open-source, 34 proprietary), believing they still affect the latest versions; only five are fixed.

Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 10:17.