OT Serial-to-IP Converters: Why Healthcare and Industrial Networks Are Suddenly Vulnerable

20 new vulnerabilities in serial-to-IP converters expose healthcare and industrial networks. How to audit, patch, and monitor these critical legacy devices

Serial-to-IP Converters: The Forgotten Device Class That Connects Healthcare and Industrial Networks

Serial protocols have been the backbone of industrial and medical devices for 40 years. But modern networks run IP. To bridge that gap, organizations use serial-to-IP converters—small devices that translate serial communication (RS-232, RS-485) into Ethernet packets.

These devices are ubiquitous and invisible. A hospital's blood gas analyzer, a utility's SCADA controller, a manufacturing facility's programmable logic controller (PLC)—many connect to the network through serial-to-IP converters made by companies like Lantronix and Silex.

Recent research has revealed something alarming: these devices are riddled with vulnerabilities.

The Vulnerability Landscape: 20 New Issues in Two Vendors

Security researchers at Forescout recently disclosed 20 previously-unknown vulnerabilities across Lantronix and Silex serial-to-IP converters. The devices are used in hospitals, power plants, water utilities, and manufacturing facilities.

The vulnerability classes include:

Plaintext credential storage: Credentials stored unencrypted in device memory or configuration files
Weak authentication: Default credentials, no rate limiting on login attempts
Command injection: The device accepts HTTP requests that are unsafely processed, allowing code execution
Unencrypted telnet access: Management traffic sent in plaintext
Missing input validation: Data from serial devices is echoed to network without sanitization
Privilege escalation: Low-privilege users can execute system commands

Why These Devices Are So Vulnerable

Serial-to-IP converters are built on embedded Linux with minimal security investment:

Legacy design: The original designs were built when network threats weren't a concern. Security was bolted on later, if at all.
Firmware updates are rare: These devices are often "set and forget." A hospital network might have converters running firmware from 2018.
No security monitoring: Unlike servers, these devices aren't in your SIEM. There's no logging of who accessed them or what commands were run.
Supply chain invisibility: Procurement teams buy them from integrators, not directly, and don't maintain a clear inventory.
Backwards compatibility constraints: Updating a converter might break 20-year-old medical equipment, so updates are avoided.

The Attack Chain: From Converter to Network Compromise

An attacker who compromises a serial-to-IP converter gains:

1. Control of Legacy Devices

A compromised converter can modify serial traffic to a hospital blood gas analyzer, causing it to report false results
An attacker can command a manufacturing PLC to stop production or damage equipment
An attacker can change SCADA readings in a power utility

2. Lateral Movement into Hospital Networks

Most serial-to-IP converters sit on the same network segment as modern servers
From the converter, an attacker can scan the network for computers, printers, and access points
The converter becomes a pivot point into the hospital's clinical system network

3. Data Interception

Medical device data (patient vitals, medication dispensation) flows through the converter
An attacker can intercept, modify, or log this data
For utilities, SCADA data reveals system state, enabling targeted attacks

4. Supply Chain Attack

The converter can be manipulated to send false sensor data to dependent systems
A manufacturing facility's quality control systems might accept "good" parts that are actually defective
A hospital's pharmacy system might accept false medication inventory counts

Real-World Scenario: A Hospital Compromise

Imagine a hospital with legacy infusion pumps connected to the network via serial-to-IP converters:

1. An attacker exploits a command injection vulnerability in the converter

2. The attacker gains shell access and disables logging

3. The attacker modifies the serial traffic to report incorrect medication concentrations

4. Patients receive incorrect doses; some are harmed

5. The hospital's logs show nothing; the infusion pumps themselves show the correct values

6. By the time the attack is discovered, it's via patient harm, not security monitoring

This isn't theoretical. In 2021, the CISA warned about similar attacks in healthcare. In 2023, ransomware groups specifically targeted OT converters as the first-stage compromise point in hospital networks.

Defense Strategy: Treating OT Converters as Critical Infrastructure

Immediate inventory and assessment:

Audit all serial-to-IP converters: where are they, what devices do they connect to, when was firmware last updated?
Check Forescout's list of affected Lantronix and Silex models for vulnerabilities
Prioritize hospital and utility converters over manufacturing (medical attacks have higher patient safety impact)

Firmware updates:

Lantronix and Silex have released patches for many (not all) vulnerabilities
Plan converter updates during maintenance windows; test with simulation of serial devices before production deployment
Subscribe to vendor security advisories; many organizations miss OT updates because they're not on vendor mailing lists

Network segmentation:

Serial-to-IP converters should not be on the same network as clinical/operational systems
Use a separate "OT DMZ" with limited routing to corporate networks
Implement micro-segmentation: converters should only communicate with the specific devices they serve

Monitoring and detection:

Enable logging on the converter (most have disabled by default)
Monitor for unexpected login attempts, command execution, or configuration changes
Alert on unusual serial traffic (e.g., commands to medical devices outside normal operating hours)
Implement network microsegmentation to detect lateral movement from a compromised converter

Access control:

Change default credentials immediately
Disable telnet; use SSH with certificate authentication only
Implement IP whitelisting: only specific administrators' computers should be able to access the converter
Disable unnecessary services (web interfaces, SNMP) if not in use

Why This Is a Systemic Problem

The serial-to-IP converter vulnerability is emblematic of a broader issue: OT and medical device security is treated as a separate concern, not part of IT security strategy. These devices are invisible to procurement, security teams don't audit them, and patching is deferred indefinitely.

Organizations need to:

Assign ownership: someone should be accountable for converter security
Fund replacements: some converters are too old to patch; budgets need to cover retirement
Integrate OT into security monitoring: converters should trigger the same alerts as servers

The good news: patching these devices is straightforward, and the exploit complexity is moderate. The bad news: without deliberate effort, most converters will remain vulnerable indefinitely.

---

Take action: Schedule an audit of your serial-to-IP converters this week. The patches are available. The risk is documented. The only remaining variable is whether your organization prioritizes it.