AI-assisted research finds 66 flaws; older devices lack fixes

Forescout researchers used commercially available artificial intelligence to identify 66 previously unknown vulnerabilities in embedded networking software. Siemens lists no planned fixes for some older products affected by related flaws.

The researchers validated 99 vulnerabilities across 10 TCP/IP stacks, the software that allows connected devices to communicate over networks, according to Forescout’s announcement Nov. 12. The findings cover open-source code and proprietary software used in embedded devices.

Forescout reported 54 of the new vulnerabilities to vendors or maintainers because they appeared to affect current software versions. The remaining findings involved older versions, were still being assessed or awaited further disclosure.

The research system combined conventional code analysis with Anthropic’s Claude models. It examined source code and proprietary binaries, then used dynamic testing to check whether suspected vulnerabilities could be exploited. Researchers supervised the process and guided tests when needed.

Forescout reported about 10 hours of automated analysis and roughly 80 hours of human-led validation. It compared that work with about nine months of manual analysis in an earlier project. The target groups differed, so the comparison was not a controlled test.

Model spending totaled about $935 for static analysis and an estimated $1,200 to $2,300 overall. The figures cover use of an already developed system and exclude the work needed to build the system, create testing infrastructure, refine prompts and analysis rules, and emulate embedded software.

The system rediscovered 33 of 82 known vulnerabilities in a previously studied group, a rate of about 40%. Forescout reported lower effectiveness for flaws tied to specific implementations and broader design decisions.

Several findings affect building-automation products listed in a Siemens advisory published Oct. 13. The advisory covers specified APOGEE, TALON and Desigo PXC/PXM products. Depending on the product and vulnerability, an unauthenticated remote attacker could read device memory or cause a denial-of-service condition.

Siemens lists updates for certain APOGEE PXC and TALON variants. It lists no planned fixes for specified APOGEE MBC/MEC and Desigo products, and recommends mitigations such as disabling affected FTP or web services and placing controllers behind network segmentation, gateways or firewalls. Siemens lists those services as disabled by default on the named product lines.

Another finding affects lwIP, an open-source networking stack. A maintainer fix published Oct. 26 addresses an MQTT parsing loop that can occur with certain buffer configurations. Forescout reported that a malicious messaging broker could exploit the flaw with a crafted message and freeze a device’s network services.

The disclosure process remains incomplete. Three proprietary stacks are still under investigation, while Ethernut has not responded. Some open-source CVE identifiers have yet to be assigned.

Forescout recommends limiting unnecessary network exposure, isolating devices that cannot receive patches and installing available updates. The research announcement does not establish that any Siemens update has been installed on affected devices.