26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation

Research details vulnerabilities in the Zephyr Real Time Operating Systems and MCUboot, both used in IoT devices and sensors.

Newly discovered vulnerabilities in Internet of Things (IoT) components could expose a range of connected devices to denial-of-service (DoS) attacks and privilege escalation, a researcher with NCC Group reports.
The report details 26 vulnerabilities in the Zephyr Real Time Operating Systems (RTOS), which is specifically designed for IoT applications, and MCUboot, an open source, hardware-independent bootloader seen as a companion project to Zephyr, said NCC Group technical director Jeremy Boone in a blog post on the research, which was conducted in January and February of 2020.
Both of these components exist in a range of IoT sensors and devices including baby monitors, LEDs, smart wearables, and IoT wireless gateways. Zephyr RTOS is supported by several major vendors including Intel, NXP, Nordic Semiconductor, and Texas Instruments; it also supports a wide range of chipset architectures and development kits.
NCC Group discovered 25 vulnerabilities affecting the Zephyr RTOS and one affecting MCUboot. Researchers found both locally and remotely exploitable memory corruption flaws, multiple paths that could let a compromised user application to escalate privilege to kernel mode, and multiple weaknesses in the design of certain exploit mitigation systems that exist in the kernel.
As of the research publication date, 15 of these 26 problems have been addressed.
The remaining unpatched findings pose a low overall risk as they represent denial of service vulnerabilities, or opportunities to further harden the kernel by improving existing exploit mitigation systems, the report states. Zephyr has indicated to NCC Group that these lower-risk issues are outside the 90-day embargo policy and they will address them in a future release.
Read more details and download the full findings
here
.

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really bad day in cybersecurity. Click for
more information and to register
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation