4 MIN READ
The technique used to find the vulnerabilities nobody else knows about runs as firmware extraction. Pull the firmware off the device, drop it into a disassembler, look for the hardcoded credential the developer forgot, the backdoor the manufacturer left, the old OpenSSL the vendor never updated. Cisco, Juniper, Netgear, TP Link, the major networking vendors all ship devices that can be opened this way, and the tooling to do it is free. Binwalk, the Firmware Analysis Toolkit, FACT, all of it on GitHub, all of it well documented, all of it used by both sides of the fight.
The 2026 firmware market has matured. Cameras, routers, printers, the smart home devices, all of them run firmware that can be pulled apart. The CVE database tracks the findings, the disclosure programs coordinate the fix, the IoT security labels are starting to show up on the consumer packaging. Tooling and disclosure have both improved. The question that remains is which side runs the analysis first.
How the firmware gets pulled
Four paths cover most of the cases. The vendor website sits as the easiest, with the firmware posted for the legitimate download and pulled the same way the customer would. The MITM against the update server is the next step, with the device phoning home for the new firmware, the request intercepted, the binary captured, and the analysis starting before the patch reaches any device. The physical extraction runs as the most thorough option, with the case opened, the flash chip read with a cheap programmer, and the actual signed image recovered with the actual signing keys. The supply chain leak is the path that requires no technical skill at all, with a contract manufacturer in Shenzhen, a developer laptop left in a coffee shop, or a misconfigured S3 bucket all producing the firmware on a silver platter.
What shows up in the analysis
Three categories of finding drive most of the breaches. The hardcoded credential leads, with the default password, the backdoor SSH key, the management API token, all of them sitting in the firmware image because the developer never expected the file to be read. Mandiant’s work on the Ubiquiti breach, Kaspersky’s analysis of HP iLO, the independent disclosure on the Dahua cameras, all of them started the same way. The backdoor is the other common pattern, with the debug interface left enabled, the undocumented API the support team uses, the vendor access account that bypasses the user authentication. Outdated libraries round out the list, with old OpenSSL, old busybox, old Linux kernel, all of them carrying CVEs that are public and weaponised.
What the defender can do
Subscribe to the vulnerability disclosure program of the manufacturer. CISA, the CERT channels, the vendor advisory mailing list, all of them notify the security team about the vulnerability the manufacturer has fixed and the patch that is available. The subscription sits as the lowest cost, highest return control in the firmware playbook, and the one most enterprises skip.
Run the firmware scanning tool against the inventory. Binwalk, the Firmware Analysis Toolkit, FACT, all of them read a firmware image and surface the old library, the hardcoded credential, the known CVE. The scan takes an afternoon. The scan gives the platform org the list it can hand to the procurement lead.
Buy from the manufacturers that invest in the security by design. The disclosure program, the secure update process, the firmware signing, the transparency about third party libraries, all of them signal a vendor that takes the problem seriously. The vendor that does not signal it sits as the vendor that ends up on the front page of the next disclosure.
The bottom line
Subscribe to the disclosure program, scan the inventory, buy from the manufacturers that signal they take the problem seriously. The org that runs those three finds the vulnerability first. The one that just waits for the patch loses the window.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
