Critical Unpatched Flaws Found in Widespread Embedded Filesystem

A recently disclosed set of vulnerabilities in the FatFs filesystem library poses a significant risk to millions of embedded devices. FatFs enables devices to interact with common storage formats like FAT and exFAT, which are widely used on USB drives and SD cards. Because the library is bundled into firmware across numerous industries, the impact of these flaws could be far-reaching.

The vulnerabilities were uncovered by security firm runZero and affect the core functionality of devices that rely on removable storage. From security cameras to hardware crypto wallets, many systems could be vulnerable to attacks exploiting these issues. With no patches currently available, organizations must assess their exposure and monitor for updates or mitigations.

Affected Systems and Risk

• FatFs is integrated into firmware for security cameras, drones, industrial control systems, and hardware cryptocurrency wallets.
• Attackers may exploit the flaws through malicious USB or SD card interactions.
• Successful exploitation could result in arbitrary code execution or full device takeover.
• Many affected devices lack straightforward update mechanisms, complicating remediation.

Current Status and Recommendations

• No patches have been released by the FatFs maintainers as of the disclosure.
• Device manufacturers are being notified to evaluate their exposure.
• Organizations should audit their embedded systems for use of FatFs.
• Defensive measures may include disabling unnecessary USB/SD interfaces where possible.
• Security teams should monitor vendor advisories for patched versions or workarounds.

Sources

• Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices