833-847-3280
Schedule a Call

Many Internet of Things Devices Have Significant Vulnerability

Internet of Things

Last week, JSOF published 19 vulnerabilities found in Internet of Things devices. Ripple20 is the name for the collection of vulnerabilities.

JSOF is a team of experienced cyber security professionals, with a wide and deep understanding of software, technology, and security.  They have deemed this situation as high risk because it affects hundreds of millions of devices.  The vulnerabilities include multiple remote code executions.  Some examples of such code execution are industrial control devices.  Malfunctions can occur at any time or date. For example, an intravenous infusion pump used in the healthcare world could have its behavior changed by this vulnerability.  Imagine a drip rate changing or adding more medication than it is intended to for a patient.  Even worse is that a malicious actor could hide vulnerable codes in the back end of these devices for years as they operate under normal conditions.  Then one day a malicious hack is sent out for execution and this will make the devices a zero-day hack or act like sleeper agents.

Where do these vulnerabilities stem from?

The discovered vulnerabilities stem from Treck’s TCP/IP library.  This is used to allow computers to communicate over long distances.  Essentially, information is broken down into small packets and “sent individually over many different routes at the same time.”  The “IP” in TCP/IP ensures that the packets are sent to the correct destination. Once those packets reach their destination, they are then reassembled.  TCP is the portion that collects and reassembles the data to its correct form to fulfill an execution.

Many Internet of Things devices use TCP/IP, and has been in use since the 1970’s.  Additionally, more than 50 major vendors may be affected. This means the vulnerabilities have been spread far and wide over a few decades.

Why is this such a big deal?

Per JSOF, “in all scenarios, an attacker can gain complete control over the targeted device remotely, with no user interaction required.”  While many of the vulnerabilities were discovered in the past and there have been patch updates established, a lot of these devices continue to operate on outdated versions of TCP/IP.

Some vulnerabilities are rated as critical; meaning there could be severe ramifications if updates aren’t implemented prior to the exploit is pushed out. One such example is in the DNS protocol, which could potentially be exploited over the internet, from outside of the network.  This could even occur on devices that aren’t connected to the internet.

Ok, how do we fix it?

The first step a corporation should take is to perform a risk assessment.  This assessment will assist in the discovery of the potentially impacted devices.  After the discovery, an update of the devices will be required.  If that isn’t feasible, then a workaround will need to be in place to ensure the devices and people are safe from being comprised in the future.  Treck states they have updated the latest version of TCP/IPv4/v6.  Therefore, updates or mitigations are readily available.  The biggest concern for corporations should not be “Do we have infected devices?”, but moreover “We discovered the known devices and have an action plan on implementing a fix”.

Latest Posts

A transparent image used for creating empty spaces in columns
In today’s digital landscape, cyberattacks are relentless, sophisticated, and increasingly costly. Yet, many government regulations designed to protect sensitive data and critical infrastructure fall short, not because they lack good intentions, but because they fail to explicitly require penetration testing as a standard practice. This regulatory ambiguity…
A transparent image used for creating empty spaces in columns
 Every IT manager knows the drill. You schedule your annual penetration test, the security team arrives, runs their tools, and delivers a comprehensive report detailing vulnerabilities and recommendations. You check the compliance box, file the report, and get back to your daily grind. Fast…
A transparent image used for creating empty spaces in columns
When a major brand like Victoria’s Secret, MGM, or T-Mobile gets hacked, it’s all over the news. These companies are household names, and a breach affecting them often exposes millions of customer records, making it a national, or even global, story. But what about small…
A transparent image used for creating empty spaces in columns
 Choosing a penetration tester isn’t just about credentials or price; it’s about trust, depth, and the results they deliver. In today’s rapidly evolving cybersecurity landscape, selecting the right penetration testing partner is more critical than ever. At MainNerve, we’ve witnessed significant shifts in the…
A transparent image used for creating empty spaces in columns
Cybersecurity threats in 2025 are evolving faster than most organizations can keep pace with. In early 2025, a global financial institution paid out a staggering $75 million following a ransomware attack. The cause? A single, compromised endpoint tied to a legacy application that had gone…
A transparent image used for creating empty spaces in columns
   Targeted retesting focuses only on the vulnerabilities you’ve already remediated. It’s scoped tightly around the affected systems, configurations, or application components that were updated, patched, or re-engineered in response to findings from the original penetration test. This approach offers several key benefits: 1.…
contact

Our Team

Name(Required)
This field is for validation purposes and should be left unchanged.
On Load
Where? .serviceMM
What? Mega Menu: Services