URGENT/11 vulnerability

Introduction

Vulnerabilities are not present in mainline enterprise operating systems (OS) alone — they can also be found in the Real Time Operating Systems (RTOS) used in critical infrastructure, medical and other critical industries.

URGENT/11 is one of these RTOS vulnerabilities and has been discovered in third-party network communication software known as IPnet. This set of vulnerabilities is known to affect industrial, SCADA, medical and enterprise devices and offers us a great example of an RTOS vulnerability. 

This article will detail the URGENT/11 vulnerability and will explore what URGENT/11 is, the vulnerabilities that URGENT/11 comprises, URGENT/11 attack scenarios and more.

What is an RTOS?

Before you can understand URGENT/11, you have to understand the universe it exists in. Most enterprise and consumer computer OS are general-purpose, which means they can run multiple applications at the same time to maximize system functionality for the user. 

Sponsorships Available

Sponsorships Available

Sponsorships Available

RTOS is a type of OS that has a far more predictable scheduler because it only runs one application at a time. This predictability is essential when information must be quickly processed without delay — including SCADA, medical and some enterprises. Security is almost more important for RTOS than general OS because any security compromise may disrupt its time-sensitive operations, so it is no surprise that vulnerabilities are rarer for RTOS.

What is URGENT/11?

Discovered by a research team at Armis Labs, URGENT/11 is a set of vulnerabilities found in weak code in a third-party network communication software called IPnet on the VxWorks RTOS, affecting all versions since 6.5 (excluding versions designed for certification). It should be noted that before VxWorks was acquired in 2006, IPnet was used with a variety of other RTOSs which may be impacted by URGENT/11, but there is no hard evidence of infection in these RTOSs.

URGENT/11 is (Read more...)