Firmware in plain English
Almost every electronic device contains firmware: the Wi-Fi router, the network printer, the access control system, the heating controls, or the machine on the factory floor. The software sits on a memory chip in the device and starts automatically when the device is switched on. Unlike a program on your PC, it isn’t something you install yourself – it comes preinstalled from the factory.
A comparison: if the device were a car, the firmware would be its engine control unit. You can’t see it, but nothing runs without it. And whoever manipulates it determines how the engine behaves.
The name comes from “firm,” as in fixed: it refers to software that is closely tied to the hardware. Even so, modern firmware can usually be updated – provided the manufacturer supplies updates and someone installs them.
How firmware works – and where the risks lie
In many connected devices, the firmware is a complete small operating system, often based on Linux. It includes a web server, network services, and numerous open-source libraries – freely available software building blocks that manufacturers incorporate into their products. Typical vulnerabilities include:
- Hard-coded credentials: Service passwords that are identical on all devices in a product line and cannot be changed.
- Identical secret keys: Cryptographic keys that should be unique to each device but are the same everywhere. If you know one, you know them all.
- Outdated components: Libraries with long-known vulnerabilities because the manufacturer never updated them.
- Insecure updates: Updates without a digital signature – that is, without the manufacturer’s tamper-proof seal of authenticity. An attacker can then install manipulated firmware.
- Open debug interfaces: Diagnostic and programming ports on the circuit board (such as UART or JTAG) that provide direct access to the system.
In a firmware analysis, experts first obtain the firmware image – a complete copy of the device software – either from an update download provided by the manufacturer or directly from the memory chip. They then unpack it and examine files, configurations, and programs. With reverse engineering – analysis without the source code – they can also understand hidden functions and proprietary protocols.
A practical example
Here’s a typical scenario: A manufacturer of electric vehicle charging stations has the firmware of its new model analyzed before market launch. The testing team reads the memory chip directly from the circuit board and unpacks the image. It turns out that the built-in web server uses a library that hasn’t been updated in years and contains several known vulnerabilities. In addition, the update mechanism doesn’t check for a digital signature.
An attacker on the same network could have installed manipulated firmware and taken permanent control of the charging station. The manufacturer updates the library, introduces signed updates, and creates a software bill of materials so it can respond faster to future vulnerabilities.
Why does this matter for businesses?
For operators, the challenge is that firmware-based devices are often missing from the inventory and rarely updated. A compromised camera or printer can give attackers an inconspicuous way into the network. In industrial settings, manipulated firmware in controllers can even affect physical processes.
For manufacturers, firmware security is becoming mandatory. The Cyber Resilience Act (Regulation (EU) 2024/2847) requires, among other things, security from the development stage onward for products with digital elements. Manufacturers must also fix vulnerabilities throughout the entire support period – generally for at least five years. Since September 11, 2026, actively exploited vulnerabilities and severe security incidents have been subject to mandatory reporting; most of the remaining obligations apply from December 11, 2027. A software bill of materials (SBOM) helps you find affected components quickly.
How to protect your organization
- Keep an inventory: Record all connected devices with manufacturer, model, and firmware version.
- Plan updates: Include firmware in your patch management and replace devices that no longer receive updates.
- Change default settings: Set your own passwords and disable services you don’t need.
- Isolate devices: Operate connected devices and controllers in separate network zones, apart from office IT.
- Ask before you buy: Look for committed security updates, the length of support, and an SBOM.
- Take precautions as a manufacturer: Sign updates and use Secure Boot, which has the device check at startup whether the firmware is unmodified. Assign individual credentials and lock down debug interfaces on production devices.
How Rootsektor can help
As part of our penetration tests for OT, ICS/SCADA & IoT, we analyze the firmware of controllers, gateways, and IoT devices – from the extracted image to the hardware interfaces. For in-depth analysis without source code, we combine this with our Code Review & Reverse Engineering service. You receive concrete remediation recommendations for operations or development. You can get a fixed-price quote after scoping via our Pentest Quote page.