Twenty-plus years of connecting everything in our lives to the internet has brought us to a place where our ability to innovate and sustain our existence relies in some way on computer code.
Meanwhile, the emergence and prevalence of these cyber physical systems that have a direct touchpoint to the physical world is forcing a new paradigm of risk management decisions.
That’s the context under which we have revamped our biannual report. The State of XIoT Security report was created to help decision makers understand the threat and vulnerability landscape affecting not only the industrial sector but also healthcare and commercial.
Interestingly enough the data in the first half of 2022 report that we’re sharing today for the first time reflects this expansion into the Extended Internet of Things (XIoT). Among the 747 XIoT vulnerabilities (86 affected vendors) published in the 1H 2022, we’re seeing for the first time real movement in the number of published vulnerabilities around enterprise IoT and progress in updating firmware and providing remediations for these components deep within cyber physical systems.
Firmware updates traditionally lag behind software patching and mitigations, for example, but in this report we’re seeing updates for both almost on par with each other. This indicates that enterprise risk managers are looking at connected embedded systems that make up the XIoT, assessing the risk to the systems, and are making progress and patching and updating them.
We hope you find the State of XIoT Security report an important resource that you will share with security executives and the board, as well as with network analysts, engineers, asset owners and operators, and managers responsible for the security of enterprise IoT.
Let’s look at some key findings:
You can see that OT vulnerabilities still dominate Team82’s dataset for the 1H 2022, but it’s noteworthy that the percentage of IoT vulnerabilities has almost doubled since our last report, especially impacting connected smart devices, routers and other networking gear, and cameras—all of which if compromised may afford an attacker deeper access to the enterprise network.
Most of the published XIoT vulnerabilities in the 1H 2022 are either critical (19%) or high severity (46%). And of those severe bugs, many affect the availability of XIoT devices by enabling code execution or denial-of-service attacks.
With the rise in cyber-physical systems across industries, we’re starting to see the expected spikes in published firmware vulnerabilities in IoT devices, as well as the internet of medical things (IoMT), and operational technology devices at Levels 1 and 2 of the Purdue Model for ICS.
Below, you can see that for the 1H 2022, the number of published firmware vulnerabilities is almost on par with software vulnerabilities, a significant reversal from the 2H 2021 report when there was an almost 2-to-1 disparity between software and firmware vulnerabilities.
Meanwhile, vulnerabilities in connected IoT devices—largely firmware issues—trail only Operations Management and Basic Control devices. Vulnerabilities in these products, which include Historian and OPC servers, as well as field devices, for example, are predominantly software-based.
Team82’s 1H 2022 dataset indicates that vendors provided full or partial remediation for 91% of published vulnerabilities.
Breaking that down by software and firmware vulnerabilities, you can see the gains made in firmware fixes for the first half of the year compared to our last report.
When a software patch or firmware update isn’t immediately available, basic security practices should be adhered to in order to blunt the impact of vulnerabilities. Here are the top mitigation steps from Team82’s 1H 2022 dataset.
CWE-23 RELATIVE PATH TRAVERSAL:
An 'Arbitary File Deletion' in Samsung DMS (Data Management Server) allows attackers to delete arbitary files from unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
Samsung recommends users to contact a Samsung call center or installer for a software update.
This product is not intended to be connected to the Internet, so please disconnect it from the Internet. Refer to the following statement in the manual: "Use this product only in a separate dedicated network. Samsung Electronics is not liable for any problems caused by connecting it to the Internet or an intranet."
CVSS v3: 8.1
CWE-22 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL'):
An 'Arbitary File Creation' in Samsung DMS (Data Management Server) allows attackers to create arbitary files in unintended locations on the filesystem. Exploitation is restricted to specific, authorized private IP addresses.
Samsung recommends users to contact a Samsung call center or installer for a software update.
This product is not intended to be connected to the Internet, so please disconnect it from the Internet. Refer to the following statement in the manual: "Use this product only in a separate dedicated network. Samsung Electronics is not liable for any problems caused by connecting it to the Internet or an intranet."
CVSS v3: 7.2
CWE-22 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY PATHNAME TO A A RESTRICTED DIRECTORY ('PATH TRAVERSAL'):
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Samsung DMS (Data Management Server) allows authenticated attackers to create arbitary files in unintended locations on the filesystem.
Samsung recommends users to contact a Samsung call center or installer for a software update.
This product is not intended to be connected to the Internet, so please disconnect it from the Internet. Refer to the following statement in the manual: "Use this product only in a separate dedicated network. Samsung Electronics is not liable for any problems caused by connecting it to the Internet or an intranet."
CVSS v3: 7.1
CWE-36 ABSOLUTE PATH TRAVERSAL:
Absolute Path Traversal in Samsung DMS (Data Management Server) allows authenticated attacker (Administrator) to read sensitive files.
Samsung recommends users to contact a Samsung call center or installer for a software update.
This product is not intended to be connected to the Internet, so please disconnect it from the Internet. Refer to the following statement in the manual: "Use this product only in a separate dedicated network. Samsung Electronics is not liable for any problems caused by connecting it to the Internet or an intranet."
CVSS v3: 4.9
CWE-502 DESERIALIZATION OF UNTRUSTED DATA:
Deserialization of Untrusted Data in Samsung DMS (Data Management Server) allows attackers to execute arbitary code via write file to system.
Samsung recommends users to contact a Samsung call center or installer for a software update.
This product is not intended to be connected to the Internet, so please disconnect it from the Internet. Refer to the following statement in the manual: "Use this product only in a separate dedicated network. Samsung Electronics is not liable for any problems caused by connecting it to the Internet or an intranet."
CVSS v3: 8.0