Forescout researchers used an Anthropic system combining code analysis and dynamic testing to validate 99 vulnerabilities across 10 TCP/IP stacks, including 66 previously unknown flaws. Automated analysis took about 10 hours, followed by 80 hours of dynamic validation, while the system’s development and infrastructure were excluded from the comparison. Forescout reported 54 new vulnerabilities to vendors and estimated model spending at $1,200 to $2,300, excluding setup and expert research costs. Siemens has released updates for some APOGEE PXC and TALON controllers, but no fixes are planned for certain APOGEE MBC/MEC and Desigo products, requiring mitigations. The method nevertheless rediscovered 33 known flaws out of 82, or 40%, and was less effective at detecting implementation-specific logic and design flaws.
Source: Read the original article
