Researcher discovers and helps patch 13 vulnerabilities in open source IoT OS FreeRTOS and Amazon's AWS secure connectivity modules using the OS
Researchers have found that a popular Internet of Things real-time operating system - FreeRTOS - is riddled with serious vulnerabilities.
Context & Ripple Effects
Amazon entered the microcontroller IoT market less than a year ago with Amazon FreeRTOS, its own distribution of the widely used open source real-time OS bundled with AWS secure connectivity libraries — so this disclosure lands directly on a product AWS is actively marketing to device makers.
The finding also extends a run of embedded-firmware audits: researchers had already exposed 13 years of serious flaws in Wind River's VxWorks, another dominant commercial RTOS, making FreeRTOS the second major embedded OS in a year shown to carry systemic vulnerabilities.
First-order effects
- Device manufacturers shipping FreeRTOS or the AWS secure connectivity modules need to apply patches across their product lines, since the flaws sit in code they did not write but baked into their firmware.
- AWS faces an immediate credibility test on its IoT security pitch: the company launched Amazon FreeRTOS as a managed, hardened foundation for microcontroller devices, and that foundation is now the vulnerability surface itself.
Second-order effects
- Because FreeRTOS is shared infrastructure rather than a single vendor's product, every OEM using it inherits the same patch burden at once — turning a coordinated disclosure into a fleet-wide firmware update problem for the entire ecosystem of AWS-connected devices.
- Rivals selling commercial RTOSes and connectivity stacks now have both a marketing opening against AWS and a warning shot: VxWorks' own flaw history shows no vendor in this category can assume its codebase is clean.
Third-order effects
- The pattern — one researcher, one codebase, millions of downstream devices — points toward systematic auditing of foundational embedded components, the direction later work on shared TCP/IP stacks (Amnesia:33) and Bluetooth firmware (BrakTooth) confirmed, and toward enterprises tracking which open source components actually ship inside their products, as the Linux Foundation/Harvard FOSS usage study began formalizing.
- If shared-component disclosures keep landing at this rate, IoT procurement will shift toward vendors who can demonstrate component-level security provenance and fast patch pipelines, restructuring how embedded software is sourced and maintained.
The trend: IoT security research is converging on the shared foundational layers — RTOSes, TCP/IP stacks, Bluetooth firmware — where a single vulnerability propagates across millions of devices from many vendors at once.