4 MIN READ
Hardware hacking used to be the kind of work that needed a lab coat, a thousand dollars of test gear, and a quiet week with the device open on the bench. The lab gear has dropped in price by an order of magnitude. The skills have spread. The disclosure norms have caught up. The CISO who thought firmware was the vendor’s problem is the CISO reading about the next CVE in the morning paper.
Lineage worth knowing. The Bus Pirate, the ChipWhisperer, and the JTAGulator are open hardware tools any researcher can buy for a few hundred dollars and have on the bench in a week. DefCon talks that used to require a research grant now happen on a kitchen table. The disclosure norms have followed, and the CISA, the ICS-CERT, and the major vendor security advisories all run on the same 90 day coordinated disclosure clock. The result: a firmware vulnerability that would have stayed in a conference paper in 2015 turns into a CVE in the news in 2026, and the company that bought the device from the trusted vendor now has to either patch the device or explain why it did not.
What the typical finding looks like
Three patterns account for most of what the working researcher finds when the researcher opens a modern IoT or industrial device. The hardcoded credential, where the developer left the default SSH key, the backdoor password, or the test account in the firmware, and any attacker who can extract the firmware (which the ChipWhisperer makes almost trivial) can read the credential in an afternoon. The debug interface left enabled, where the manufacturer shipped the device with the JTAG, the UART, or the SWD pins still exposed, and the attacker connects a debugger, reads the firmware, and walks past the authentication. The known vulnerable library, where the firmware still ships with the old OpenSSL, the busybox from 2018, the Linux kernel that has had three CVEs since the vendor froze the build, all sitting in the security scanner’s report the moment the scanner looks at the firmware image. None of these are exotic. They show up in the average device the average researcher pulls apart.
Why this matters to the buyer
The supply chain reach is what turned hardware hacking from a hobby into a board topic. A single firmware vulnerability in a single device now ships in the firmware update the vendor pushes to every customer at once. The Mirai botnet was a 2016 wake up call, and the trend has only accelerated since. The router, the camera, the industrial controller, the building management system, all running the same handful of firmware libraries, all on the same 90 day disclosure clock, all exposed the moment the CVE lands. The procurement lead who buys the device without asking for the SBOM (the software bill of materials) cannot answer the question the CISO will be asked the morning the disclosure publishes.
What the defender does
Inventory the firmware, before the disclosure, not after. The security team can build a firmware inventory from the SBOM the procurement lead requires at the contract stage, or by pulling the firmware image from each device and running a binary SBOM tool against it. The output is the asset list the rest of the program runs against.
Subscribe to the disclosure feeds the day the device goes live. CISA, ICS-CERT, the vendor security advisory list, and the project mailing list for the open source libraries the firmware depends on. The subscription is free. The missed disclosure costs the incident.
Patch on a schedule, not on a panic. The operations team tests the firmware patch in the lab before the operations team deploys it, runs the rollout through the MDM or the vendor management tool, and tracks the cycle time from CVE published to patch deployed. The company that ships the patch inside 30 days of disclosure usually avoids the weaponisation window. The company that waits for the next audit cycle tends to lose the data first.
The bottom line
Firmware inventory, disclosure subscription, patch cadence the operations team actually runs. The CISO who treats firmware as the vendor’s problem reads about the next CVE in the morning paper. The CISO who treats it as a defensible asset list reads about it from a position of having already patched.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
