Legacy Gear, Modern Risks: BRIDGE:BREAK and Serial-to-Ethernet Exposure

Hey folks,

Just caught the Forescout Vedere Labs report on the "BRIDGE:BREAK" campaign, and it’s a stark reminder of how our legacy infrastructure comes back to bite us. They've uncovered 22 new vulnerabilities affecting Lantronix and Silex serial-to-IP converters. If you're managing OT or industrial sites, these are the dusty little boxes translating RS-232 to Ethernet that everyone forgets about until the line goes down.

The vulnerabilities allow for full device hijacking and data tampering. With nearly 20,000 exposed to the internet, the attack surface is significant. The flaws include authentication bypasses and command injection vulnerabilities.

Since these devices often sit transparently between controllers and the network, detecting tampering is tough. I wrote a quick Python snippet to scan our internal asset list for the default web interfaces of the affected Lantronix PremierWave series.

import requests

def check_lantronix(ip):
    try:
        r = requests.get(f"http://{ip}/index.html", timeout=5)
        if "Lantronix" in r.headers.get('Server', '') or "PremierWave" in r.text:
            return True
    except Exception:
        pass
    return False

# Usage example
print(check_lantronix("192.168.1.50"))

The real kicker is that patching these often requires a physical serial connection and downtime for the manufacturing line. How is everyone handling remediation for these? Are you strictly enforcing network segmentation, or have you had luck pushing firmware updates?