1. Introduction

The rapid proliferation of IoT technology is reshaping the production and lifestyle of human society, with widespread applications in smart homes, industrial automation, and smart cities deeply embedded in modern life [1]. However, this technological empowerment conceals severe security challenges. From 2020 to 2022, the number of IoT firmware vulnerabilities continued to rise at an average annual rate of 31.6%. Cases such as the Mirai botnet, which built a distributed denial-of-service attack platform by invading camera firmware, and the Stuxnet virus, which used PLC firmware vulnerabilities to implement targeted physical destruction, reveal that firmware security has evolved from a technical issue to a strategic issue concerning personal privacy, economic security, and even national critical infrastructure. Current research primarily focuses on technical implementations such as static analysis and fuzzing, but neglects the complex interaction of technical defects, organizational management, and policy environment in the process of vulnerability formation. This single-dimensional research paradigm struggles to explain why the severity of the same technical vulnerabilities varies significantly across different supply chain systems.

The international community has recognized the essential characteristics of this systemic risk. The U.S. NIST, in its "IoT Device Cybersecurity Baseline," embedded security design principles into the technical standard lifecycle for the first time. The European Union is constructing technical barriers to market access through the IoT trust label system. These measures mark a paradigm shift in security governance from passive response to active prevention. It is worth noting that China's "13th Five-Year Plan" industrial control security special support for resilience assessment indicator system research, and the vulnerability repair decision model based on differential games, are forming theoretical breakthroughs with local characteristics, providing Eastern wisdom for global IoT security governance.

This paper presents an in-depth investigation into firmware vulnerabilities within the IoT ecosystem. We begin by examining the root causes of these vulnerabilities, including design flaws, development errors, and supply chain issues, elucidating how these factors contribute to the emergence of firmware exploits. Subsequently, we explore various detection techniques, such as static analysis, fuzzing, and deep learning-based approaches, detailing their applications and associated challenges. Furthermore, we establish a hazard assessment and grading model within the evaluation framework to analyze the scope of vulnerability impacts. In the management and prevention strategies section, we propose comprehensive mitigation measures from technical, managerial, and policy/regulatory perspectives, while also discussing their implementation pathways and effectiveness.

2. The formation of IoT firmware vulnerabilities

The architecture of the IoT is typically divided into four primary layers: the perception layer, the network layer, the platform layer, and the application layer. The perception layer, as the foundational level of the IoT, is primarily responsible for collecting real-world data through various sensors and devices. The network layer undertakes the task of data transmission, ensuring that data can be smoothly transferred from the perception layer to the application layer. The platform layer provides core functions such as data storage, processing, and device and service management. The application layer, as the top layer of the IoT, offers more specific applications and services to users. Security risks may exist in each layer of this architecture.

Firmware refers to the collection of all programs running on the CPU, an indispensable part of IoT devices. Unlike embedded programs in traditional computer hardware, firmware stores hardware information, system configurations, and user data. Therefore, once a firmware vulnerability occurs, it may directly lead to severe consequences such as hardware damage, user privacy leakage, or service interruption [1]. The formation of firmware vulnerabilities mainly stems from three aspects: design defects, errors during the development process, and supply chain issues.

2.1. Design flaw

During the development of IoT firmware, design flaws are a significant source of security vulnerabilities, already existing in the system architecture design and functional planning stages. Initially, the absence of input validation mechanisms is a core design flaw. Research indicates that some IoT device firmware lacks comprehensive consideration of input data validation mechanisms during the design phase. Attackers can exploit this by constructing malicious input data, bypassing device security boundaries through injection attacks or triggering abnormal behaviors. Furthermore, weakened security mechanisms exacerbate the risks. Some manufacturers, prioritizing functional efficiency, employ unencrypted communication protocols or omit authentication steps, exposing devices to threats such as man-in-the-middle attacks.

2.2. Errors in the development process

Developers may introduce various errors during code writing, potentially stemming from a lack of attention to or unfamiliarity with secure coding practices [2]. For instance, buffer overflows represent a common programming error, where writing data beyond the buffer's capacity can enable attackers to manipulate program execution and gain control of the device. Logical errors may arise from developers' misinterpretations of requirements or flaws in algorithm design, leading to anomalous device behavior under specific conditions, thus providing opportunities for attackers. Furthermore, developers' improper resource management (e.g., failure to release file handles or memory correctly) can lead to resource exhaustion, rendering the device inoperable. In addition, improper configuration of the development environment, such as using insecure compilation options or ignoring security warnings, can also sow the seeds of problems.

2.3. Supply chain issues

The proliferation and increasing complexity of Internet of Things (IoT) devices have expanded the scope and diversity of supply chains, inevitably leading to the integration of third-party components and open-source libraries during firmware development. While these components and libraries can expedite development and reduce costs, they may also introduce known or unknown security vulnerabilities. For instance, open-source components like OpenSSL, widely used in IoT device firmware, can become entry points for attackers if not promptly updated or audited. Furthermore, the complexity of the supply chain complicates firmware updates and maintenance, particularly when multiple vendors and diverse architectures are involved. Inadequate firmware update mechanisms can result in the persistence of security vulnerabilities. Developers often lack comprehensive security assessments when integrating third-party components, exacerbating supply chain issues. Moreover, the absence of effective security auditing and vulnerability management mechanisms in vendor supply chain management leads to numerous unpatched vulnerabilities in deployed firmware. Supply chain issues in IoT firmware not only increase the risk of vulnerability formation but also potentially amplify the scope and impact of these vulnerabilities.

3. Vulnerability mining and detection in IoT firmware

The firmware of IoT devices, acting as the core for hardware-software interaction, critically determines both operational integrity and user privacy. Vulnerabilities within the firmware can lead to device compromise, sensitive data breaches, and even network outages. Consequently, the investigation of efficient, automated firmware vulnerability detection techniques is of paramount importance. Such techniques facilitate the timely identification of vulnerabilities prior to firmware deployment, thereby mitigating potential damage from future attacks. Furthermore, they enable the analysis of a large volume of firmware within a constrained timeframe, optimizing both human resources and financial expenditures. Current automated vulnerability detection methodologies primarily encompass static analysis, symbolic execution, fuzzing, and machine learning techniques. This study will subsequently analyze static analysis, fuzzing, and deep learning-based detection techniques.

3.1. Static analysis techniques

As one of the core methods for IoT firmware vulnerability mining, static analysis techniques provide deep parsing of binary code through non-execution state analysis, aiming at discovering potential vulnerabilities with the significant advantage of not needing to rely on the runtime environment [3]. These techniques are rooted in formal program analysis, employing lexical analysis, syntactic analysis, and the construction of control flow graphs and data dependency graphs to verify code compliance with critical security, reliability, and maintainability metrics. Given the proprietary nature of most IoT firmware, where source code or design documentation is rarely available, static analysis heavily relies on reverse engineering and static program analysis methodologies [4].

3.1.1. Refinement of the technical process

The technical workflow refinement encompasses the entire process, from firmware acquisition to vulnerability detection. Initially, raw firmware files are obtained via hardware debugging interfaces (e.g., UART, JTAG) or vendor repositories. Subsequently, entropy analysis or magic number matching is employed to ascertain whether the firmware is encrypted or compressed. Following this, firmware unpacking tools (such as Binwalk) are utilized to parse the file system structure and extract executable modules. In instances where the firmware lacks a defined file system, self-organizing algorithms or semi-supervised learning methods are integrated to pinpoint critical code segments. Building upon this, binary code is transformed into an intermediate language, and control flow graphs (CFGs) and data dependency graphs (DDGs) are constructed. Address relocation issues are addressed through base address inference or symbolic execution. Ultimately, vulnerability pattern matching is performed based on static analysis rule sets and taint analysis techniques. This includes tracking taint propagation paths to detect buffer overflows or format string vulnerabilities, and identifying unvalidated user input points [5].

3.1.2. Technical limitations

While static analysis techniques have achieved considerable maturity in the context of structured firmware, several challenges persist in the analysis of bare-metal firmware. The absence of standardized load addresses in bare-metal firmware leads to fragmented disassembly results. Existing research employs dynamic symbolic execution coupled with hardware emulation to infer execution contexts, yet their efficiency and accuracy are still constrained by the path explosion problem [5]. Furthermore, vendors employ code obfuscation or custom instruction sets to safeguard intellectual property, significantly reducing the success rate of traditional static analysis tools such as IDA Pro and Ghidra. In addition, the heterogeneous architectural characteristics of IoT devices make existing tools have semantic gaps for non-x86 platforms, and need to rely on architectural description languages to enhance cross-platform analysis capabilities.

3.2. Fuzzing techniques

Fuzzing represents a highly effective dynamic analysis methodology for the detection of vulnerabilities within IoT firmware. At its core, fuzzing leverages automated generation of malformed inputs to trigger unexpected behaviors in the target system, thereby identifying potential vulnerabilities. Unlike static analysis techniques, fuzzing does not necessitate prior knowledge of code semantics, making it particularly well-suited for the analysis of closed-source firmware and the discovery of zero-day exploits. Based on the observability of program information, fuzzing can be categorized into black-box, grey-box, and white-box approaches, with grey-box fuzzing emerging as the dominant paradigm in IoT firmware testing due to its balance of efficiency and coverage [4].

3.2.1. The primary application scenarios for fuzzing

The testing regimen primarily encompasses fuzzing of IoT device-specific communication protocols, such as MQTT and CoAP, to identify vulnerabilities within protocol implementations. Furthermore, it involves the assessment of security risks associated with the interaction interfaces between the kernel and peripheral hardware components, including WiFi chips and sensors. Finally, the process validates the device's processing logic and behavioral stability under anomalous input scenarios by simulating atypical user input data.

3.2.2. Challenges in fuzzing

In the realm of test case generation, fuzzing tools often exhibit a reliance on byte-level mutation techniques due to an inadequate understanding of communication protocols. This results in the generation of a substantial number of invalid seeds that do not conform to protocol specifications, thereby significantly diminishing efficiency. Furthermore, the acquisition of high-quality initial seed sets continues to depend on manual expertise, which presents challenges in ensuring diversity and representativeness. Regarding device emulation accuracy, current technologies demonstrate insufficient capabilities in simulating complex hardware environments and the specialized peripherals of IoT devices, such as customized components. This deficiency leads to discrepancies between simulation outcomes and actual operational states, potentially failing to trigger genuine vulnerabilities. In addition, anomaly detection methods have both false alarm and omission problems. The former escalates the cost of manual verification, while the latter may lead to the oversight of potential risks, directly impacting the comprehensiveness of vulnerability discovery.

3.3. Deep learning-based detection techniques

Deep learning, a potent artificial intelligence technique, facilitates efficient feature learning and pattern recognition in complex data through the construction of multi-layered neural network architectures. Deep learning-based IoT firmware vulnerability detection leverages deep learning algorithms and techniques to analyze and detect vulnerabilities in IoT device firmware, which are often missed by traditional methods [1].

3.3.1. Applications of deep learning in vulnerability detection

The application of deep learning in firmware security analysis manifests as multi-level automation capabilities. By constructing multi-layered neural network models, deep feature representations of firmware code can be automatically learned. For instance, the Gemini model utilizes binary functions generated from the same source code under different platform and compiler optimization levels to construct large-scale training datasets, significantly enhancing the generalization ability for unseen functions [6]. Simultaneously, integrating static node analysis with deep learning techniques enables the identification of potential security features and vulnerability patterns in firmware, achieving precise localization of IoT software vulnerabilities through the extraction of node selection rules. Furthermore, cross-platform detection capabilities, achieved by converting structures like Control Flow Graphs (CFG) into advanced digital feature vectors (as designed in the Genius tool), effectively eliminate differences across various architectures and platforms, addressing the scalability issues in vulnerability detection [7]. These methods collectively improve the accuracy and adaptability of vulnerability identification.

3.3.2. Challenges of deep learning detection techniques

The application of deep learning techniques is confronted with several challenges. Initially, the reliance on extensive, high-quality labeled datasets inflates training costs and significantly complicates data acquisition. Secondly, the intricate nature of model architectures necessitates substantial computational resources for both training and inference. Furthermore, the limited interpretability of decision-making processes, particularly in safety-critical domains, restricts model trustworthiness and practical utility, thereby posing a significant constraint on real-world deployment.

4. Evaluation of IoT firmware vulnerabilities

4.1. Hazard assessment and classification

Hazard assessment of IoT firmware vulnerabilities is a critical component of vulnerability management, aimed at quantifying the multi-dimensional impact of vulnerabilities on device operation, user privacy, and system security. Specifically, vulnerabilities can directly compromise device functionality, such as buffer overflows leading to device crashes or privilege escalation enabling complete device control by attackers, resulting in service disruptions or device failures. Simultaneously, user privacy is at risk of exposure, as vulnerabilities in smart cameras, for example, can be exploited to steal video surveillance data, geolocation, or personally identifiable information. Moreover, system integrity may be compromised by attackers tampering with firmware or configurations, such as firmware downgrade attacks that force devices to revert to older versions with known vulnerabilities, leading to unpredictable system behavior. These potential threats collectively constitute a composite security risk for IoT devices across functional, privacy, and system levels.

To facilitate vulnerability impact classification, a standardized scoring system such as the Common Vulnerability Scoring System (CVSS) can be employed. CVSS provides a set of quantifiable metrics for assessing vulnerability severity, encompassing attack complexity, attack vector, and impact scope. Through CVSS scoring, vulnerabilities can be categorized into four severity levels: low, medium, high, and critical, thereby assisting security teams in prioritizing high-risk vulnerabilities [8].

4.2. Impact scope assessment

Scope of impact assessment as a core component of quantitative analysis of vulnerability hazards, necessitating multi-layered system modeling to elucidate the propagation paths and destructive potential of potential threats. This assessment framework must encompass the following three progressive levels: At the individual device level, the direct impact of the vulnerability on the target device's functional integrity, privacy protection mechanisms, and security control capabilities must be quantified. At the system network level, the risk of lateral penetration within the IoT topology must be evaluated, such as exploiting vulnerabilities in inter-device communication protocols to construct botnets, leading to large-scale device coordination failures [9]. At the critical infrastructure level, the cascading effects of vulnerabilities on core systems such as energy and transportation must be analyzed. A typical example includes firmware vulnerabilities in metering terminals within smart grids, which may trigger a cascading failure of regional power supply systems through supply chain contamination.

5. Management and prevention of IoT firmware vulnerabilities

5.1. Technical prevention measures

Firmware encryption, employing cryptographic algorithms such as AES and RSA, is crucial for maintaining firmware integrity and confidentiality, thereby mitigating the risks of interception or tampering during transmission and storage. This ensures that only authorized devices can decrypt and execute the firmware. Secure boot mechanisms, by verifying digital signatures, guarantee that devices initiate operations from trusted firmware, thus preventing the loading of compromised firmware. A robust vulnerability remediation strategy necessitates the regular release of firmware updates by manufacturers to address known vulnerabilities, coupled with automated update capabilities. Furthermore, establishing a comprehensive vulnerability reporting and response system is essential to encourage user reporting and expedite the patching process. Device authentication and authorization, leveraging protocols like OAuth and TLS, are implemented to restrict network access to authorized devices, thereby preventing unauthorized intrusions [10]. Data isolation and access control measures, through the implementation of data segregation and permission restrictions, are designed to minimize data leakage risks, safeguard sensitive data from unauthorized access, and limit user and application privileges, thereby protecting data confidentiality and integrity.

5.2. Management-level preventive measures

Security policy formulation necessitates comprehensive coverage of device management, data protection, and network communication, explicitly defining device access controls, data encryption protocols, and firmware update procedures, with provisions for periodic review and updates. Supply chain management must ensure the security of IoT devices and firmware, mandating the selection of reputable vendors and rigorous scrutiny of supply chain components to prevent the introduction of malicious firmware or compromised devices. User education and training are designed to enhance user security awareness, providing instruction on secure device usage practices, such as the implementation of strong passwords, regular firmware updates, and the avoidance of insecure networks. Security auditing and monitoring, employing periodic audits, log analysis, intrusion detection systems, and security information and event management systems, are essential for real-time monitoring of device and network security status, enabling the prompt identification and resolution of security vulnerabilities. An incident response plan should encompass incident detection, response workflows, and recovery measures, with provisions for regular drills and updates to ensure the capacity for rapid response and mitigation of damages in the event of a security incident.

5.3. Regulatory and legal prevention measures

Regulatory and legal measures for mitigation encompass mandatory firmware updates, compelling manufacturers to furnish regular updates to ensure timely vulnerability remediation and mitigate security risks stemming from outdated firmware. This is particularly critical in power grid automation networks, given the extended operational lifespans of power equipment [11]. Furthermore, establishing a security certification system, mandating that IoT devices undergo and pass security certification prior to market release, is essential for ensuring adherence to security standards and enhancing overall security posture. Moreover, clearly defining the security responsibilities of manufacturers and users through legislation, and implementing accountability for losses resulting from security breaches, will incentivize stakeholders to prioritize device security. Finally, strengthening international collaboration and standardization efforts to jointly develop international standards and norms for IoT security will facilitate technical exchange and standardization across different nations and regions, thereby elevating the security of global IoT devices. These measures collectively constitute a regulatory and legal framework for mitigation, designed to institutionally safeguard the security and reliability of IoT devices.

6. Conclusion

This paper presents a comprehensive analysis of the origins, detection, and prevention mechanisms for vulnerabilities in IoT firmware. The root causes are categorized into three primary areas: design flaws, development errors, and supply chain risks. Regarding detection techniques, static analysis is limited by path explosion, leading to inefficiency. Dynamic fuzzing faces challenges in balancing the simulation accuracy and performance constraints of resource-limited devices. Furthermore, deep learning-based detection methods are restricted by the availability of high-quality labeled data, which limits their practical application. To address these issues, this paper proposes an integrated defense framework. Technically, it advocates for the complementarity of high-coverage static analysis and the authenticity of dynamic testing. From a management perspective, a full lifecycle security mechanism is needed, strengthening firmware updates and security audit processes. At the policy and regulatory level, the standardization and mandatory certification of IoT security standards should be promoted to improve the overall security level of the industry by regulating market access.

This research offers both theoretical and practical value. Theoretically, by systematically summarizing the common characteristics of IoT firmware vulnerabilities, it reveals the evolution patterns and propagation paths of vulnerabilities, extending fundamental network security theories to the embedded systems domain. Simultaneously, the integration of deep learning and fuzzing overcomes the limitations of traditional static analysis, constructing a cross-disciplinary methodological framework for vulnerability detection technology. In practice, the research findings guide device manufacturers to optimize secure coding standards and firmware update mechanisms, reducing the attack surface of devices at the factory. It also enhances end-users' awareness of potential device threats, promoting the implementation of proactive defense measures. Moreover, it provides data support for policymakers, driving the formulation of mandatory industry security standards and full lifecycle regulatory policies.

Future research in IoT firmware vulnerability analysis will concentrate on the innovation and optimization of intelligent, automated, and cross-platform detection technologies. AI-driven vulnerability detection techniques are expected to become dominant. Enhancements to deep learning model architectures and training algorithms will be crucial for improving training efficiency and detection accuracy, while also reducing the reliance on extensive labeled datasets, thereby better accommodating the demands of large-scale firmware analysis [2]. Future studies should build upon existing achievements, continuously exploring new technologies and methodologies to advance vulnerability detection to a higher level, contributing to the construction of a secure and reliable IoT ecosystem.