Eleven zero-day vulnerabilities in WindRiver\u2019s VxWorks, a real-time operating system in use across an advertised 2 billion connected devices have been discovered by network security vendor Armis.\nSix of the vulnerabilities could enable remote attackers to access unpatched systems without any user interaction, even through a firewall according to Armis.\n\nThe vulnerabilities affect all devices running VxWorks version 6.5 and later with the exception of VxWorks 7, issued July 19, which patches the flaws. That means the attack windows may have been open for more than 13 years.\nArmis Labs said that affected devices included SCADA controllers, patient monitors, MRI machines, VOIP phones and even network firewalls, specifying that users in the medical and industrial fields should be particularly quick about patching the software.\nThanks to remote-code-execution vulnerabilities, unpatched devices can be compromised by a maliciously crafted IP packet that doesn\u2019t need device-specific tailoring, and every vulnerable device on a given network can be targeted more or less simultaneously.\nThe Armis researchers said that, because the most severe of the issues targets \u201cesoteric parts of the TCP\/IP stack that are almost never used by legitimate applications,\u201d specific rules for the open source Snort security framework can be imposed to detect exploits.\nVxWorks, which has been in use since the 1980s, is a popular real-time OS, used in industrial, medical and many other applications that require extremely low latency and response time. While highly reliable, the inability to install a security agent alongside the operating system makes it vulnerable, said Armis, and the proprietary source code makes it more difficult to detect problems.\nArmis argued that more attention has to be paid by security researchers to real-time operating systems, particularly given the explosive growth in IoT usage \u2013 for one thing, the researchers said, any software that doesn\u2019t get thoroughly researched runs a higher risk of having serious vulnerabilities go unaddressed. For another, the critical nature of many IoT use cases means that the consequences of a compromised device are potentially very serious.\n\u201cIt is inconvenient to have your phone put out of use, but it\u2019s an entirely different story to have your manufacturing plant shut down,\u201d the Armis team wrote. \u201cA compromised industrial controller could shut down a factory, and a pwned patient monitor could have a life-threatening effect.\u201d\nIn addition to the six headlining vulnerabilities, five somewhat less serious security holes were found. These could lead to consequences ranging from denial of service and leaked information to logic flaws and memory issues.\nMore technical details and a fuller overview of the problem can be found at the Armis Labs blog post here, and there are partial lists available of companies and devices that run VxWorks available on Wikipedia and at Wind River\u2019s customer page. Wind River itself issued a security advisory here, which contains some potential mitigation techniques.