TCP/IP stacks are embedded in connected products across these sectors, meaning vulnerabilities in shared software components can affect hundreds of downstream products from multiple vendors.

This is especially impactful for critical infrastructure, where legacy and difficult-to-patch devices may remain in service for years.”

TCP/IP stacks are embedded in products used across OT, IoT, medical devices, network equipment and other cyber-physical systems.

“This is expected because we used static analysis rules focused on generic code patterns rather than specific implementations.

Binary targets were far more complex, with static analysis averaging six times more expensive and taking twice as long.