Affected Systems
FatFs filesystem library used in embedded devices including security cameras, drones, industrial controllers, and hardware crypto wallets. Affects devices reading/writing FAT and exFAT formats on USB drives and SD cards. Specific vulnerable versions not disclosed.
Exploitation Status
No CVE assigned. Vulnerabilities disclosed by runZero but remain unpatched. Active exploitation status unknown. No public PoC availability mentioned.
Business Impact
High-severity flaws in widely-deployed library create supply chain risk across diverse device categories. Devices processing untrusted FAT/exFAT media (USB drives, SD cards) are at risk. Lack of patches means remediation limited to vendor firmware updates or operational controls. Impact scope difficult to assess without device inventory showing FatFs usage.
Urgency
🟡 Within a week
Recommended Actions
- Inventory embedded devices and firmware to identify FatFs library usage, prioritizing internet-facing security cameras and critical industrial controllers
- Restrict physical access to USB ports and SD card slots on affected devices until patches become available
- Monitor vendor security advisories for firmware updates addressing FatFs vulnerabilities
- Implement network segmentation to isolate vulnerable embedded devices from critical networks
- Disable auto-mount or auto-execute features for removable media on affected systems where operationally feasible