VxWorks Debug Service Information Disclosure Attempt
This alert is triggered when detecting an attempt to access the VxWorks Debug Service. VxWorks is a real-time operating system (RTOS) developed by Wind River Systems. The debug service in VxWorks is a feature used by developers for troubleshooting and optimization; however, it can disclose sensitive information if it's improperly secured. This alert may be triggered when an adversary is attempting to exploit the VxWorks Debug Service by sending crafted packets to port 17185 in order to extract sensitive information, such as configuration data or operational details of the targeted device.
ID Number
4000056
Signature
alert udp any any -> any 17185 (msg:"VxWorks Debug Service Information Disclosure Attempt"; reference:url,digitalbond.com/tools/quickdraw/vulnerability-rules; sid:4000056; priority:2;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
It is recommended to review the network traffic logs to identify any unauthorized or suspicious access attempts on port 17185. Verify whether this activity was a legitimate test performed by an authorized individual or team within your organization. If not, this could indicate suspicious activity, and the source of this traffic should be further investigated.