The Department of Homeland Security’s (DHS) Federal Emergency Management Agency (FEMA) has issued an Integrated Public Alert and Warning System (IPAWS) advisory concerning critical vulnerabilities in unpatched Emergency Alert System (EAS) encoder/decoder devices that could be exploited by state-sponsored threat actors to conduct nationwide disinformation campaigns. The exploit has been demonstrated in a proof-of-concept (PoC) by CYBIR.com’s Ken Pyle. If exploited, attackers could issue fraudulent EAS alerts over AM, FM, and satellite radio, as well as broadcast, cable, and satellite TV infrastructure. Following successful exploitation, Pyle stated that he could “…easily obtain access to the credentials, certs, devices, exploit the web server, send fake alerts via crafts message”. Pyle further stated that this exploit could enable an attacker to prevent legitimate users from accessing the system, “neutralizing or disabling a response” by emergency personnel. In his PoC writeup, Pyle discovered multiple vulnerabilities in the Monroe Electronics R189 One-Net DASDEC EAS device, which was confirmed by other researchers. Many of these unpatched flaws are several years old, and Pyle states that these less severe vulnerabilities have now, “snowballed into a huge flaw.” The EAS is critical to national security, and administrators responsible for these systems must ensure that they are up-to-date with the most recent secure version. To add defense-in-depth, FEMA strongly encourages that all EAS devices are protected behind a firewall and that audit logs are regularly reviewed to identify malicious behavior in EAS devices and the systems supporting them. With the uptick in state sponsored malicious campaigns following Russia’s invasion of Ukraine, mitigating threats to critical infrastructure should be given the utmost priority. The specific details of the vulnerabilities have been withheld to prevent active exploitation by malicious actors, although FEMA reports that it may be publicly demonstrated at the 2022 DEF CON hacking conference in Las Vegas in August. If the PoC isn’t shown during DEFCON, then it will be publicly released in the coming weeks according to FEMA.