Do not expose your RIGOL oscilloscopes to the internet

Re:Do not expose your RIGOL oscilloscopes to the internet by hadrien01 on Sunday July 16, 2023 @12:16PM (#36748611)

I was very confused by the date format, so here's the timeline with ISO dates:

Vulnerability found, 2022-11-08

Sent detailed PoC, 2022-11-09

RIGOL says they would have contacted me with updates from R&D, 2022-11-09

Follow-up on the vulnerability, 2023-01-25

RIGOL says they would reply in 2-3 days, 2023-01-28

Full disclosure, 2023-02-08

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by stavros on Sunday July 16, 2023 @12:24PM (#36748691)

Does this mean they never patched this, then?

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by psychphysic on Sunday July 16, 2023 @12:57PM (#36749111)

So odd to list a timeline but not enough detail to work out what happened.

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by ericpauley on Sunday July 16, 2023 @01:17PM (#36749342)

Such is life with CVEs, unfortunately. While there are some great central repositories of information there is often very little in the way of consistent information on the disclosure process itself.

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by Eduard on Sunday July 16, 2023 @04:52PM (#36751287)

It's pretty clear to work out what happened from the timeline listed: RIGOL didn’t do shit.

The style the author chose to list the timeline is IMHO the most faithful, honest, and polite way of communicating it without adding wrong or legally problematic reasoning to the situation, from their perspective.

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by psychphysic on Sunday July 16, 2023 @05:12PM (#36751454)

Nah, "no response received from RIGOL" if that's the case is faithful, honest and polite.

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by jjoonathan on Sunday July 16, 2023 @04:51PM (#36751278)

This is RIGOL we are talking about. In a year, they will release a firmware that solves the RCE but opens two more and also breaks cursors (or some other very basic thing). A year after that, they will release a second firmware that fixes the cursors but breaks the calibration and still has the two new RCEs.

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by anitil on Sunday July 16, 2023 @07:55PM (#36752596)

In my experience this is most firmware vendors

[ Parent | on HN ]

Re:Do not expose your RIGOL oscilloscopes to the internet by mensi on Monday July 17, 2023 @03:53PM (#36763162)

I actually reported the same pair of bugs to them 2021-03-01, so I don't think they're interested in fixing it...

[ Parent | on HN ]