upvote
IoT devices will get fixes delivered on the 12th of never.
reply
So, the good news is that I can probably now get root on almost any Linux-based device I own. Don't even need to solder on a serial port or w/e, just direct network connection.
reply
Yeah this is really a blessing for people seeking more control over nice hardware with horrible software, "smart" spy TVs, Android (moar ads on your) TV boxes, cheap insecure security camera's with only Crappy Cloud subscriptions... Go AI!
reply
Needs two cpus at least, so a lot IoTs are spared because of that
reply
But are they exploitably vulnerable to this specifically in typical setups?
reply
To be fair probably not as many will be single core and this requires multi-core. As for the thousands of other CVEs though ...
reply
Dual or quad core is not that unusual even in very cheap SoCs, but this particular CVE needs a kernel line from this decade. Thousands of other CVEs indeed..
reply
The security fixed will be installed next tuesday.
reply
Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj But then it turns out that this "applies from" late 2027 :/

Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)

reply
That's how i'd read it but i'm not 100% sure. legal terms can have specific meanings in a legal context that's different from general use.

but also this is one of those cases where, ok you have a law, but, that's meaningless. It's not enforceable. It's not even monitorable. It's nice in theory to write down a bunch of regulations but at best you can make a bunch of EU companies do some paperwork. anything imported from outside the EU, the company can agree to everything and then dissapear. ALl the direct to consumer slop on amazon and whatever. How is the EU supposed to enforce a law against a random fly by night brand name in Shenzhen?

From https://taxation-customs.ec.europa.eu/news/report-highlights...

> As volumes rise, enforcement is weakening. In 2025, the EU control rate fell to 65 items per million items imported. The rate of goods ultimately refused at the border due to non-compliance or because they posed serious risks, also fell to below 10 items per million.

> A large-scale customs investigation launched by the Commission in 2025 highlights the scale of the problem. Over 60% of checked toys, small electronics, cosmetics, personal protective equipment and food supplements bought online from outside the EU failed to meet EU product compliance and safety requirements.

It's just regulation theater. It's meaningless.

reply
You should assume your IoT junk is already compromised, that's why your IoT junk runs on a dedicated VLAN.
reply
What kernel is the router managing these VLANs running?
reply
An updated one 'cause you're running a virtual router in a container or VM which gets all the updates your server(s) get.
reply
They're on a dedicated VLAN in the county dump
reply
Desktop Linux in typical setups? Consumer modems and routers?
reply
[dead]
reply
I think fix arrived like two weeks ago or something. So typical Desktop Linux is safe. I use Arch btw
reply