Security Experts:

Connect with us

Hi, what are you looking for?



XIoT Vendors Show Progress on Discovering, Fixing Firmware Vulnerabilities

Self-disclosures by XIoT vendors have surpassed independent research outfits as the second most prolific vulnerability reporters

Self-disclosures by XIoT vendors have surpassed independent research outfits as the second most prolific vulnerability reporters

A major impact of the pandemic has been the acceleration of digital transformation, which has expanded from advanced digitization into increasingly unmanaged automation. This automation is largely controlled by unmanaged cyber/physical devices. It started with the first generation of largely consumer oriented IoT devices but has grown into what some now call Industry 5.0.

The key aspect is no longer simply whether the device has internet connectivity, but whether it performs its functions automatically in an unmanaged fashion. This has become so much wider and more complex than the original concept of IoT or even IIoT. It now includes automatically functioning medical devices, building controls, smart city management, many aspects of OT and industrial control systems, and much more.

Rather than define terms for the different types of ‘IoT’, industrial cybersecurity firm Claroty has settled on an umbrella phrase: the extended internet of things (XIoT). This effectively refers to and includes any unmanaged device, which is inherently more difficult to secure than any managed device (that is, one operated by a human manager). This is the cyber/physical domain, and notably, 70% of vulnerabilities can be targeted remotely over the internet.

Claroty, a firm focused on securing the cyber/physical space, has published its State of XIoT Security report (PDF) covering the first half of 2022, and focusing on vulnerabilities and vulnerability disclosures. The total number of disclosures is relatively flat (747, affecting 86 different vendors), but the report notes a major improvement in vendors’ approach to their own vulnerability discovery and reporting.

“For the first time, vendor self-disclosures have surpassed independent research outfits as the second most prolific vulnerability reporters,” notes the report. Third party companies remain the top reporters (337), with vendors second (214) and independent researchers slipping to third (138).

“The improvement in vendor disclosures,” Amir Preminger, Claroty’s VP of Research, told SecurityWeek, “is down to the growing maturity of the cyber/physical market.” Threat awareness, especially the potential severity of the threats, is better understood – and manufacturers are attempting to get ahead of the game.

ICS Cybersecurity

The industry standard period allowed to manufacturers by vulnerability researchers is 90 days from reporting to disclosure. “We don’t do that,” said Preminger. “We will give the vendor as much time as he needs to patch a vulnerability before we publish any details on the vulnerabilities we discover. But I can tell you that doesn’t always happen. There have been cases where details are published before the vendor has fixed the flaw, and sometimes in less than the 90 days.”

It’s the standard full disclosure debate – but the stakes are higher with cyber/physical devices. If a vulnerability is actively exploited before a fix is available, lives could be lost. The vendors are trying to find and fix their own vulnerabilities before they can be prematurely disclosed by researchers.

Firmware vulnerabilities

A second area of improved vendor performance can be found in firmware fixes. Firmware flaws are typically more difficult to remediate than software flaws – which perhaps explains vendors’ historical response. In the second half of 2021, firmware fixes were running at 21%; but this jumped to 40% in the first half of 2022.

Preminger has seen signs of improvement for some time. It almost starts with better reporting to the company, and improved response from the company. “We must remember that although these are critical devices, the vendor is a commercial company. It needs to make money, while security fixes are a drain. That said, I am very happy to see they are improving their own goods based on their own internal review and response to researchers.”

This improvement is the first visible sign of the vendors’ growing maturity. If this is the case, the improvements should continue. “Definitely, yes,” said Preminger. “It’s a continuation of a trend we’ve been seeing for a couple of years. Currently it is strongest in the big cyber/physical companies – such as Siemens – and less so with the smaller boutique vendors.” For these larger companies, it is simply more efficient to find and remediate internally than be forced to negotiate and work with disclosure parties.

However, these improvements in vendors’ own vulnerability management cannot be seen as a relaxation of the cyber/physical threat. As Industry 5 continues to grow, there will be an increasing number of cyber/physical devices, and both the size and severity of the threat will continue to expand.

“After decades of connecting things to the internet, cyber-physical systems are having a direct impact on our experiences in the real world, including the food we eat, the water we drink, the elevators we ride, and the medical care we receive,” said Preminger The purpose of this report is to enable organizations “to properly assess, prioritize, and address risks to the mission-critical systems underpinning public safety, patient health, smart grids and utilities, and more.”

Related: COVID’s Silver Lining: The Acceleration of the Extended IoT

Related: OT Data Stolen by Ransomware Gangs Can Facilitate Cyber-Physical Attacks

Related: Cyber-Physical Security: Benchmarking to Advance Your Journey

Related: Our Rising Dependency on Cyberphysical

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...