AI helped find 66 security flaws, with no fixes planned for some older devices

Researchers at cybersecurity company Forescout used commercially available AI to find 66 previously unknown flaws in embedded networking software, exposing weaknesses that can disrupt connected devices, according to the company's Nov. 12 announcement.

The team validated 99 vulnerabilities across 10 TCP/IP stacks, the software components that let devices communicate over networks. That total included 33 rediscovered issues. Forescout reported 54 of the new findings to vendors or maintainers because it believed they still affected current versions.

The researchers built a specialized system combining conventional code analysis with Anthropic's Claude models. It examined both open-source code and proprietary binaries, then used dynamic testing to validate potential flaws. Researchers could intervene and guide that testing.

Forescout's research reports roughly 10 hours of automated analysis and 80 hours of dynamic validation. It compares that with about nine months of manual code analysis during its earlier Project Memoria work.

The comparison involves different target sets, rather than a controlled benchmark. It also excludes building that system, refining analysis rules and prompts, and developing the infrastructure needed to emulate embedded software.

Static analysis cost about $935 in model spending; Forescout estimates total model spending at roughly $1,200 to $2,300. Those figures describe the cost of applying an already-built system, rather than the full expense of expert research and setup.

The approach also had limits: it rediscovered 33 of 82 known issues, or 40%, in the previously studied target set and was less effective at finding implementation-specific logic and design flaws.

Fixes depend on the device

The study includes flaws affecting building-automation products covered by Siemens' Oct. 13 advisory. The advisory identifies vulnerabilities in specified APOGEE, TALON and Desigo PXC/PXM products. Depending on the issue and product, an unauthenticated remote attacker could read device memory or cause a denial of service.

Siemens lists updates for affected APOGEE PXC and TALON variants, but no planned fix for listed APOGEE MBC/MEC and Desigo products. It recommends issue-specific mitigations, including disabling affected FTP/web services or placing controllers behind network segmentation and properly configured gateways or firewalls. The advisory notes that FTP/web services are disabled by default on the named product lines.

Another finding involves lwIP, an open-source networking stack. An Oct. 26 maintainer fix addresses an MQTT parsing loop under certain buffer configurations. Forescout says the flaw could let a malicious messaging broker freeze a device's network services with a crafted message. Both that fix and Siemens' advisory predate the November research announcement.

Disclosure remains unfinished. Forescout's report lists three unnamed proprietary stacks as under investigation and Ethernut as having provided no response. Forescout also says open-source CVE identifiers are still awaiting assignment.

For operators, Forescout recommends reducing unnecessary service exposure, isolating devices that cannot be patched and applying available fixes. Faster discovery still leaves protection dependent on whether a vendor supports a device and whether a fix reaches it.