Security researchers have identified thirteen (13) vulnerabilities in Siemens’ Nucleus TCP/IP stack real-time operating system (RTOS), primarily deployed in automotive, industrial, and medical applications. The Nucleus TCP/IP stack is a software library that’s used in 13 billion operational technology and internet of things (IoT) devices. If exploited, the suite of vulnerabilities tracked as “NUCLEUS:13” could allow for remote code execution (RCE), denial-of-service (DoS), and the theft of sensitive information. Researchers from both Forescout and Medigate have published a proof-of-concept (PoC) exploit where they successfully showed the effects of the flaws disrupting medical care and critical processes. When describing the disruption, researchers stated that successful exploitation could, “result in devices going offline and having their logic hijacked,” and “spread[ing] malware to wherever they communicate on the network.” At this time, Siemens has released updated versions that mitigates these vulnerabilities in Nucleus ReadyStart versions 3 (update to v2017.02.4 or later) and 4 (update to v4.1.1 or later version), and administrators are urged to update immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also provided an advisory that’s summarized in the below article. The Ankura CTAPT will continue to provide the most up to date information on critical vulnerabilities to our readers, and any further Nucleus TCP/IP vulnerabilities will be reported on in future updates.