Security Secure connections? 
Software supply chain in OT/IoT routers in focus

Related Vendors

ForeScout Technologies, Inc.

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

In a joint investigation, Forescout and Finite State analyzed the software supply chain for OT/IoT routers. We have summarized the findings and are specifically looking at the DACH region.

Mobile routers connect important Operational Technology (OT) and Internet of Things (IoT) devices to the internet. These connections enable remote monitoring and control—especially where wired networks are difficult to install.

At the end of 2023, Forescout Research Vedere Labs investigated vulnerabilities in OT/IoT router provider Sierra 21. In the course of this, it was discovered that open-source software components represent a central weakness. According to the company, this was the starting signal to analyze the state of software components in OT/IoT network devices beyond one manufacturer. The goal: To understand the risk in the software supply chain due to existing, so-called N-day vulnerabilities in the latest router firmware.

Vulnerabilities in the supply chain are difficult to eliminate as firmware images often rely on outdated components to be compatible—thus threat actors can attack many devices with a single exploit. However, identifying the complex components used in common models of a particular device class is difficult on a large scale. To remedy this, Forescout teamed up with Finite State, a Software Bill of Materials provider, to analyze firmware images of common routers: Acksys, Digi, MDEX, Teltonika, and Unitronics.

View on the DACH region

Germany has the highest number of exposed devices in the DACH region, with a total of over 40 million devices. This includes critical OT and IoT devices such as power generators and industrial controls, which pose significant cybersecurity challenges.

Germany is also the country most affected by ransomware attacks in the region, with 231 registered incidents primarily targeting industries such as manufacturing, technology, and finance. Among the most frequently exploited vulnerabilities are those found in Citrix ADC, Cisco IOS, and Huawei Home Gateway devices. 24 percent of the vulnerable devices in the DACH region are non-traditional IT devices that increase the risk of cyber threats in various sectors, hence improved security measures are urgently needed.

Key findings at a glance

The key findings of the analysis are summarized below.

1. OpenWrt is everywhere: Four of the five analyzed firmware images use operating systems derived from OpenWrt, an open-source Linux-based operating system for embedded devices. However, these four firmware images use heavily modified versions of the base operating system, either by mixing and adapting individual component versions with a base version, or by developing their own components themselves.

2. The software components are often outdated: The analysis identified an average of 662 components and 2,154 findings of known vulnerabilities, weak security precautions, and potential new vulnerabilities in each firmware image. The investigation selected 25 common components and found that the average open-source component was five years and six months old and was four years and four months behind the latest version. Even the latest firmware images do not use the latest versions of open-source components, including critical components like the kernel and OpenSSL.

3. Known vulnerabilities are numerous: On average, the firmware images had 161 known vulnerabilities in their most common components: 68 with a low or medium CVSS value, 69 with a high value, and 24 with a critical value. In addition, the firmware images had an average of 20 exploitable n-days affecting the kernel.

4. There is a lack of security features: On average, 41% of all firmware image binary files use RELRO, 31% use Stack Canaries, 65% use NX, 75% use PIE, 4% use RPath, and 35% use debugging symbols. The averages can be misleading as the differences between the firmware images are very large. Overall, all five examined firmware images are inadequate regarding the binary protection mechanisms.

5. Default credentials are being phased out: Although each firmware was shipped with default login details, these were often generated once, and the user was forced to change them when configuring a device, making them unexploitable under normal circumstances.

6. Custom patching is a problem: The analysis found examples of manufacturers applying their own patches for known vulnerabilities and introducing new problems. In addition, vulnerabilities were patched without increasing the versions of the components, leading to the device user not knowing what is vulnerable and what is not.

"The 'Rough Around the Edges' report shows a troubling trend of outdated software components in OT/IoT routers, with many devices using modified versions of OpenWrt that contain known vulnerabilities," said Larry Pesce, Director of Product Research and Development at Finite State. According to the expert, these findings show how important it is to address the risks in the software supply chain. The full report can be accessed here, registration is required.