ID: INFO-04

Title: Outdated Linux kernel with known vulnerabilities

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: Both automated and manual firmware analysis confirmed the firmware runs Linux kernel version 2.6.31, built in January 2018 using GCC 4.3.3. This kernel version is end of life and no longer received security patches. Automated analysis reported 86 possible exploits associated with this kernel version. Manual analysis of the extracted kernel binary corroborated this finding, confirming the exact version string Linux version 2.6.31--LSDK-9.2.0_U6.616.

Remediation: Update to the latest supported Linux kernel version. Where a full kernel update is not feasible due to hardware constraints, apply available security patches for the identified vulnerabilities and restrict attack surface by disabling unnecessary services.

More information: See Automated Firmware Analysis and Manual Firmware Analysis chapters.