Critical Zero Days Remotely Compromise the Most Popular Real-Time OS

Critical Zero Days in VxWorks Real-Time Operating System: The Urgent11 Research Findings

**Overview**

Ben Zuri (VP Research at Armis) and Doron Derman present research on eleven critical zero-day vulnerabilities discovered in VxWorks, the world's most widely deployed real-time operating system (RTOS). VxWorks powers approximately 2 billion devices across industrial control systems, medical devices, aerospace, defense, automotive, and critical infrastructure—more devices than Android or Windows despite receiving minimal security research attention in its 32-year history. The researchers discovered these vulnerabilities in IPnet, VxWorks' default TCP/IP stack, after reverse engineering and fuzzing the network implementation. The vulnerability class spans multiple subsystems: six vulnerabilities enable remote code execution, while five provide information disclosure and denial-of-service capabilities. These are the first significant RCE vulnerabilities found in VxWorks' TCP/IP stack in decades, with potential impact affecting hundreds of millions of devices globally.

**Technical Details**

VxWorks Real-Time Operating System Architecture and Deployment:

1. **VxWorks Market Position**: - Owned by Wind River (formerly proprietary, later acquired) - Most popular RTOS in the market running on 2+ billion devices - Used by 2,000+ device manufacturers as underlying OS for their products - Preferred for deterministic timing and compact, reliable operation on priority-based scheduler - Until now, only 13 CVEs listed despite 32 years of existence (Android has 2,000+ CVEs)

2. **Critical Industry Deployment**: - Healthcare: Philips medical devices, GE healthcare equipment, hospital bedside monitors - Industrial: Schneider Electric automation, Rockwell industrial controllers - Manufacturing: CNC machines, robotic systems across major manufacturers - Aerospace/Defense: NASA spacecraft drives, military/defense systems - Enterprise: SonicWALL firewalls (~1 million units exposed on internet), commercial infrastructure - Automotive: In-vehicle systems, engine controls

3. **IPnet TCP/IP Stack Characteristics**: - Default built-in network stack for VxWorks since version 6.5 (30 years of usage) - Originally developed by InterPeak, acquired and integrated into VxWorks by Wind River - Previously distributed to other RTOS vendors (Greenhills Integrity, 3DX, OSE) - Maintains legacy code from 1980s TCP/IP specifications that haven't changed - Runs in kernel ring 0 (highest privilege level)

4. **TCP/IP Stack as Critical Attack Vector**: - Exploitation capability: Any vulnerability in TCP/IP stack is remotely exploitable via network packets - Protocol stability: TCP/IP code hasn't fundamentally changed since 1980s, reducing code churn that might expose vulnerabilities - Ancient code often contains remnant vulnerabilities never discovered or patched - Historical precedent: Win-nuke crash in Windows 95/NT; recent ICMP crash in macOS/iOS from Apple

5. **Urgent11 Vulnerability Breakdown**: - Six vulnerabilities enabling remote code execution (critical highest impact) - Five vulnerabilities enabling information leaks, denial-of-service, logical flaws - Total eleven critical vulnerabilities across multiple TCP/IP subsystems - Affected subsystems: IP layer parsing, TCP subsystem, DHCP, IGMP, RARP (Reverse ARP)

6. **IP Options Parsing Vulnerability (Detailed Example)**: - Location: IP layer packet parsing in VxWorks IPnet stack - Attack vector: Broadcast packets at IP layer (single packet impacts multiple devices) - Mechanism: IPv4 header contains optional fields for extended functionality - Exploitation: Specially crafted IP options trigger memory corruption or RCE - Impact multiplier: Broadcast delivery enables mass exploitation with single packet transmission

7. **Vulnerability Impact Scope**: - Estimated impact: Hundreds of millions of the 2 billion VxWorks devices - Some VxWorks deployments are non-networked (no impact) - Vast majority with network connectivity affected by IPnet vulnerabilities - Critical infrastructure exposure: Medical devices, industrial systems, aerospace

8. **Disclosure and Remediation Coordination**: - Disclosure timeline: Started March, 5-month coordination process at time of talk - Affected vendors releasing advisories and patches simultaneously - Philips releasing medical device patches and guidance - Rockwell releasing industrial control system advisories - SonicWALL released firewall patch; urgent recommendation for 1M exposed units to apply patches

9. **Mitigation Strategies**: - Vendor patches from Wind River for VxWorks and IPnet - Device manufacturer patches for integrated products (Philips, Rockwell, etc.) - Network segmentation: Isolate VxWorks devices on secure networks - Access control: Restrict untrusted network traffic to critical systems - Monitoring: Detect anomalous network patterns targeting known vulnerable ports

**Defense & Takeaways**

Securing VxWorks and RTOS-based critical systems: (1) Prioritize immediate patching—both VxWorks core updates from Wind River and OEM-specific patches for medical/industrial devices; given massive installed base, patch availability and deployment speed are critical; (2) Network segmentation—isolate VxWorks systems on physically or logically separated networks; prevent untrusted internet traffic from reaching RTOS-based devices; (3) Legacy OS risk assessment—assume any OS running legacy 1980s code with minimal security research history has similar dormant vulnerabilities; prioritize research and testing on under-examined embedded systems; (4) Supply chain security—verify security posture of all third-party components; medical device integrators should validate both VxWorks security and Philips-specific mitigations; (5) Medical device governance—hospitals must track VxWorks devices in their infrastructure; coordinate with procurement to ensure patches deployed; bedside monitors and patient monitoring equipment are especially critical; (6) Industrial control security—manufacturing automation systems using Rockwell or Schneider Electric platforms must validate patch compatibility; test in non-production before deploying; (7) Zero-day disclosure process—understand that coordinated disclosure can take months for wide-impact vulnerabilities; prepare mitigation strategies during disclosure window; (8) Firewall inventory—organizations running SonicWALL devices must immediately identify exposed units and apply patches; scan internet-facing infrastructure for vulnerable hardware; (9) Defense-in-depth—implement network monitoring to detect exploitation attempts targeting known vulnerable services; rate limit unusual network patterns; (10) Privileged access control—run network-based services with minimum required privileges; restrict kernel-level services that could be compromised by network attacks; (11) Protocol analysis—monitor and analyze suspicious IP options, DHCP, IGMP, RARP traffic as indicators of exploitation attempts; (12) Vendor relationships—establish direct communication with medical device manufacturers for security updates; don't rely solely on general security bulletins; (13) Life-cycle planning—begin replacement planning for VxWorks devices; many industrial and medical systems remain deployed for 10-20+ years; long-term strategy requires hardware refresh cycles; (14) Research expansion—fund additional security research on RTOS and embedded systems; 32 years with only 13 CVEs indicates massive research gap; underexamined systems likely contain more vulnerabilities; (15) Incident response—prepare response playbooks for potential exploitation; understand attack patterns for each vulnerability class (RCE vs. info leak); maintain incident response capabilities for critical infrastructure. The critical insight: VxWorks represents a significant hidden vulnerability surface that has been largely neglected by the security research community. With 2 billion devices running 32-year-old code, the discovery of 11 critical vulnerabilities—especially 6 RCE—suggests the surface is far larger than previously understood. The combination of legacy protocol code, massive deployment in critical infrastructure (hospitals, power systems, aerospace), and minimal previous scrutiny creates a perfect storm for widespread exploitation. Unlike consumer operating systems (Android, Windows) that receive continuous security research, RTOS platforms operate in a security vacuum. The Urgent11 research demonstrates that attackers or advanced state actors targeting critical infrastructure have likely discovered similar or additional vulnerabilities independently. Organizations operating medical devices, industrial control systems, and aerospace equipment must treat this research as a critical wakeup call: assume additional unknown vulnerabilities exist in VxWorks and similar legacy RTOS platforms. The 5-month disclosure timeline also reveals a critical challenge: coordinating patches across 2,000 device manufacturers is extraordinarily complex. Many organizations may never receive patches for their specific integrated products. Defense requires both vendor patches and architectural changes (network segmentation, monitoring) that work even against unknown vulnerabilities.