"Nobody looks after that software anymore. There won't be a fix."
How 33 flaws in buried network code left more than 150 vendors responsible for parts they had not made and could not repair.
The facts
What happened
Forescout disclosed 33 vulnerabilities in four open-source TCP/IP stacks, the code that embedded devices use to talk to a network.
What it caused
Potentially millions of devices from more than 150 vendors were affected. Some of the original stacks were no longer maintained and would never be patched, leaving vendors to fix or replace the code themselves.
What the CRA now asks
Due diligence when integrating third-party components (Article 13(5)); a support period of normally at least five years, which may take into account the support periods of integrated components (Article 13(8)); know which components you ship (Annex I, Part II (1)).
Source: Forescout Research Labs, AMNESIA:33
The story
Sofie had been in charge of her company's product for eleven months, and she was good at it. On a grey December morning in 2020 she was reading the news over her second coffee when she saw a story about thirty-three newly discovered weak spots in four pieces of free software, the kind that small gadgets use to connect to the internet. She did not recognise any of the four names, so she relaxed and moved on.
An hour later Rasmus, her lead engineer, knocked on the glass wall of her office and turned his laptop around so she could see. One of those four was inside their product. Not in anything they had made themselves. It was buried inside a part a supplier had sold them years before she joined. She called the supplier that afternoon and asked, politely, when they could expect a fix. There was a long pause on the line. "Nobody looks after that software anymore," the woman said. "There won't be a fix."
More than 150 companies were stuck in the same hole, each responsible for something they had not made, could not see inside, and nobody would ever repair. The Cyber Resilience Act was built for exactly this moment. A company must know every part inside its product and exercise due diligence on the parts it buys. So before buying a part, you ask the supplier how long they will keep fixing it, write the date in the calendar, and agree what happens if they stop. The phone call still happens. It just happens before you buy.
The people and scenes are illustrative. The incident and its facts are real.
The system that would have caught it
6. Get suppliers to commit in writing
Written promises from suppliers about how long they will fix security flaws in their parts, and how quickly they will warn you.
How the system worksCould you do this today?
Is every critical part supported for at least as long as you promise your customers?
If it applies, how ready are we?
Six yes-or-no questions, two minutes. Your no's come back in the order to fix them.
Not sure the CRA applies to your product? Check that first