| Recurring |
one_organization, multiple_organization |
(a) In the provided articles, the software failure incident related to vulnerabilities in the VxWorks operating system has happened again at the same organization, Wind River. The vulnerabilities, collectively dubbed Urgent/11, were found in VxWorks, impacting various devices. Wind River, the developer of VxWorks, is in the process of distributing patches for the bugs [87289].
(b) The software failure incident related to vulnerabilities in the VxWorks operating system has also happened at multiple organizations. The vulnerabilities in the networking protocols of VxWorks could potentially affect roughly 200 million devices worldwide, impacting various industries such as medical equipment, industrial control products, firewalls, routers, printers, and more. The vulnerabilities could give attackers remote device access and allow malware to spread to other VxWorks devices globally [87289]. |
| Phase (Design/Operation) |
design, operation |
(a) In the software failure incident related to the vulnerabilities in the VxWorks operating system, the failure can be attributed to contributing factors introduced during the design phase of the system development. The vulnerabilities in the networking protocols of VxWorks were discovered by Armis researchers, highlighting flaws in the system's design that allowed for remote device access and potential malware spread [87289].
(b) Additionally, the software failure incident can also be linked to contributing factors introduced during the operation phase of the system. The challenges in patching the vulnerabilities in VxWorks devices were emphasized, with the continuous operation of devices and the need for tailored patching processes making it difficult to implement fixes promptly [87289]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident related to the vulnerabilities in the VxWorks operating system, known as Urgent/11, was primarily within the system. Armis researchers discovered a cluster of 11 vulnerabilities in the platform's networking protocols, which could give an attacker remote device access and allow malware to spread to other VxWorks devices [87289]. These vulnerabilities were found in the TCP/IP stack, a foundational component that helps devices connect to networks like the internet [87289]. The vulnerabilities were present in most versions of VxWorks going back to 2006, affecting roughly 200 million devices [87289].
(b) outside_system: The software failure incident also had contributing factors originating from outside the system. The vulnerabilities in VxWorks were not limited to just that operating system but extended to other platforms that incorporated the same decades-old networking code, such as IPnet, which was licensed to various real-time operating system developers [89480]. The acquisition of Interpeak by Wind River and the subsequent lack of support for IPnet licenses allowed the vulnerabilities to persist across different systems [89480]. Additionally, the vulnerabilities could be exploited remotely, without needing a foothold from a victim, making them susceptible to attacks from afar [87289]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
- The software failure incident involving vulnerabilities in the VxWorks operating system, known as Urgent/11, was due to a suite of network protocol bugs that existed in various platforms across different manufacturers [89480].
- The vulnerabilities in the VxWorks operating system's networking protocols were discovered by researchers from Armis, and these vulnerabilities could potentially give an attacker remote device access and allow malware to spread to other VxWorks devices worldwide [87289].
- The vulnerabilities in the VxWorks operating system's network protocols were unusual and had a broad reach, affecting devices like modems, routers, printers, industrial, and medical devices [87289].
(b) The software failure incident occurring due to human actions:
- The vulnerabilities in the VxWorks operating system were found by researchers from Armis, who disclosed their findings to Wind River in March, initiating the patching process [87289].
- Wind River, the developer of VxWorks, has been working with customers to distribute patches for the vulnerabilities, but the patching process is challenging due to the continuous operation of VxWorks devices and the need for tailored patching processes [87289].
- The challenges in patching VxWorks devices highlight the difficulty in mitigating the fallout of vulnerabilities introduced in the software due to the nature of IoT and critical infrastructure updates [87289]. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident occurring due to hardware:
- The software failure incident reported in the articles is related to vulnerabilities found in the networking protocols of the VxWorks operating system, which is commonly used in devices like medical equipment, elevator controllers, and satellite modems [87289].
- The vulnerabilities in the VxWorks operating system's network protocols could potentially give attackers remote device access and allow malware to spread to other VxWorks devices worldwide, impacting roughly 200 million vulnerable devices [87289].
- The vulnerabilities in the VxWorks operating system's network protocols are considered critical and have a broad reach, affecting devices such as modems, routers, printers, industrial devices, and medical devices [87289].
- The nature of VxWorks devices, which often run continuously and depend on customized software, makes it challenging to implement patches for the vulnerabilities, as shutting down a product line to apply updates is not a feasible solution [87289].
(b) The software failure incident occurring due to software:
- The software failure incident is primarily attributed to vulnerabilities found in the networking protocols of the VxWorks operating system, which is a software component used in various devices [87289].
- The vulnerabilities in the VxWorks operating system's network protocols were discovered by researchers from Armis, highlighting a cluster of 11 vulnerabilities, six of which could potentially allow remote device access and malware propagation [87289].
- The vulnerabilities in the VxWorks operating system's network protocols are considered critical and could result in device malfunctions or full system takedowns if exploited by attackers [87289].
- Wind River, the developer of VxWorks, is in the process of distributing patches for the vulnerabilities, emphasizing the importance of patching impacted devices immediately to mitigate the risks posed by the software vulnerabilities [87289]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident discussed in the articles is malicious in nature. The vulnerabilities found in the VxWorks operating system, collectively dubbed Urgent/11, were discovered by researchers from Armis and could potentially give an attacker remote device access and allow malware to spread to other VxWorks devices [87289]. These vulnerabilities could be exploited by motivated attackers to launch attacks at a massive scale, posing a significant threat to critical infrastructure and industrial devices [87289]. The presence of these vulnerabilities in the network protocols of VxWorks allows for remote exploitation without needing a foothold from the victim, making it a serious security concern [87289].
Additionally, the incident involved a suite of network protocol bugs, Urgent/11, that exist in various platforms used in always-on devices common to industries like industrial control and healthcare [89480]. The bugs were found to have endured for a long time due to the lack of support for the IPnet licenses, leaving devices vulnerable to denial of service attacks or full takeovers [89480]. The vulnerabilities discovered in the operating systems of devices like patient monitors, routers, security cameras, and infusion pumps highlight the potential for malicious exploitation of these systems [89480]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The intent of the software failure incident related to poor decisions can be seen in the software failure incident reported in Article 89480. The incident involved vulnerabilities in the Urgent/11 suite of network protocol bugs that affected various real-time operating systems used in critical systems like patient monitors, routers, and security cameras. The vulnerabilities stemmed from a popular early-aughts implementation of network protocols that were inherited through acquisitions and lack of support for older software components. This lack of management and oversight of embedded devices led to the persistence of vulnerabilities over time, despite significant code changes in the systems. The incident highlights the consequences of poor decisions in managing software components and the challenges in addressing vulnerabilities in legacy systems ([89480]).
(b) The software failure incident related to accidental decisions can be observed in the vulnerabilities discovered in the VxWorks operating system, as reported in Article 87289. The vulnerabilities, collectively known as Urgent/11, were found in the networking protocols of VxWorks, a real-time operating system widely used in IoT and industrial control products. The presence of these vulnerabilities in the network layer was unexpected and unusual, as security vulnerabilities in this foundational component had been largely standardized industry-wide since the 1990s. The discovery of critical vulnerabilities in VxWorks, a system known for its security, was surprising and highlighted the accidental nature of the flaws that could potentially impact millions of devices worldwide ([87289]). |
| Capability (Incompetence/Accidental) |
development_incompetence, accidental |
(a) The software failure incident in the articles can be attributed to development incompetence. The vulnerabilities in the VxWorks operating system, collectively known as Urgent/11, were discovered by Armis researchers and found to be present in most versions of VxWorks going back to 2006 [87289]. The vulnerabilities in the network protocols of VxWorks were considered critical, and the patching process was described as long and difficult, especially in the context of IoT and critical infrastructure updates [87289]. The challenges in distributing patches for VxWorks devices, which are used in various critical settings like patient monitors and medical equipment, were highlighted, indicating a lack of professional competence in managing and updating these systems effectively [87289].
(b) The software failure incident can also be considered accidental to some extent. The vulnerabilities in the VxWorks operating system were surprising due to their presence in the network protocols, particularly the TCP/IP stack, which is a foundational component for devices to connect to networks like the internet [87289]. The vulnerabilities were not expected in VxWorks, a secure and real-time operating system commonly used in continuously functioning devices like medical equipment and industrial control products [87289]. The accidental nature of these vulnerabilities is further emphasized by the fact that they were not present in the latest version of VxWorks or in Wind River's certification versions, indicating that they were not intentionally introduced but rather remained unnoticed until discovered by researchers [87289]. |
| Duration |
permanent, temporary |
(a) The software failure incident related to the vulnerabilities in the VxWorks operating system, known as Urgent/11, can be considered as a permanent failure. The vulnerabilities discovered in the networking protocols of VxWorks have been present in most versions of the operating system going back to 2006 [87289]. The nature of VxWorks devices, which typically run continuously and often require customized software that complicates the patching process, makes it challenging to implement fixes for the vulnerabilities [87289]. Additionally, previous research on exploitable VxWorks bugs has shown that these vulnerabilities can persist for a long time in critical infrastructure devices, leading to what is referred to as "forever-day vulnerabilities" [87289].
(b) The software failure incident can also be considered as a temporary failure in the sense that patches are being distributed by the developer, Wind River, to address the Urgent/11 vulnerabilities in VxWorks. Wind River has been working with customers to distribute patches for the vulnerabilities for almost two months [87289]. However, the patching process is described as long and difficult, especially for IoT and critical infrastructure updates, indicating that the vulnerabilities are not immediately resolved for all affected devices [87289]. |
| Behaviour |
omission, value, other |
(a) crash: The articles do not mention a crash as the behavior of the software failure incident.
(b) omission: The software failure incident related to the vulnerabilities in VxWorks and the Urgent/11 bugs could lead to the omission of performing intended functions by the affected devices. For example, the vulnerabilities could potentially allow attackers to disrupt the normal operation of devices like patient monitors, routers, security cameras, and infusion pumps [89480, 87289].
(c) timing: The software failure incident does not relate to timing issues where the system performs its intended functions but at incorrect times.
(d) value: The vulnerabilities in VxWorks and the Urgent/11 bugs could lead to the system performing its intended functions incorrectly, potentially allowing unauthorized access, manipulation of devices, and spreading of malware [89480, 87289].
(e) byzantine: The software failure incident does not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions.
(f) other: The other behavior observed in the software failure incident is the potential for the vulnerabilities to allow remote device access, spreading of malware, and the possibility of full system takedowns, impacting critical infrastructure and devices [87289]. |