Security advisories
Plain-English explanations of named CVEs affecting industrial, medical and IoT devices, each one sourced to NVD, CISA KEV and FIRST EPSS so you can check the evidence behind the score. Every entry lists affected components, versions and the vendor’s own advisory. Not a vulnerability feed for your products — see firmware security for that.
163 results
CVE-2013-6035
CVE-2013-6035: BGAN Satellite Terminal Firmware Unauthenticated Privileged-Protocol Remote Code Execution
Hughes Network Systems BGAN satellite terminal firmware, as used in Japan Radio Corp. JUE-250/JUE-500 and other BGAN terminals
CVE-2014-2940
CVE-2014-2940: Cobham SAILOR 900/6000 VSAT Satellite Terminal Hardcoded Administrator Credentials
Cobham SAILOR 900 and SAILOR 6000 series VSAT satellite communication terminal firmware
CVE-2015-0984
CVE-2015-0984: Honeywell Excel Web XL1000 FTP Directory Traversal (Building Controller)
Honeywell Excel Web XL1000 building automation controllers
CVE-2015-7755
CVE-2015-7755: Juniper ScreenOS Unauthorized Backdoor Authentication Bypass (KEV)
Juniper ScreenOS
CVE-2015-7923
CVE-2015-7923: Westermo WeOS Industrial Switch Shared SSL Private Key
Westermo WeOS industrial Ethernet switch/router firmware
CVE-2016-4494
CVE-2016-4494: KMC Controls BAC-5051E BACnet Router CSRF Discloses Device Configuration
KMC Controls BAC-5051E BACnet router (part of KMC's Conquest series, a multi-port device that routes BACnet traffic between BACnet/IP, Ethernet and MS/TP building-automation networks and is configured entirely through a browser-based web interface; KMC's own product pages now list the BAC-5051E as discontinued in favor of the successor BAC-5051AE router)
CVE-2017-16241
CVE-2017-16241: AMAG Symmetry Door Edge Network Controller Unauthenticated Lock/Unlock Command Injection
AMAG Technology Symmetry Door Edge networked door controller (physical access-control hardware that drives electric door locks and card readers directly, used standalone or as part of a larger Symmetry access-control system)
CVE-2017-20235
CVE-2017-20235: ProSoft Technology ICX35-HWC Cellular Gateway Authentication Bypass (Water/Wastewater Remote Telemetry)
ProSoft Technology ICX35-HWC Industrial Cellular Gateway firmware (web user interface)
CVE-2017-2780
CVE-2017-2780: InsideSecure MatrixSSL X.509 Certificate Parsing Heap Buffer Overflow
InsideSecure MatrixSSL (embedded TLS/SSL and cryptography library, originally developed by PeerSec Networks, used by IoT and other resource-constrained client/server firmware)
CVE-2017-7921
CVE-2017-7921: Hikvision IP Camera Improper Authentication Bypass (KEV)
Hikvision IP cameras (DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx and DS-2CD63xx series)
CVE-2018-1000500
CVE-2018-1000500: BusyBox wget Missing SSL Certificate Validation
BusyBox (wget applet)
CVE-2018-10635
CVE-2018-10635: Universal Robots CB 3.1 Controller Unauthenticated URScript Code Execution
Universal Robots CB 3.1 robot controller firmware (UR3, UR5, UR10 collaborative arms)
CVE-2018-11462
CVE-2018-11462: Siemens SINUMERIK CNC Controller Remote Privilege Escalation
Siemens SINUMERIK 808D, 828D, and 840D sl CNC controller firmware
CVE-2018-1285
CVE-2018-1285: Apache log4net XXE Bundled in Applied Systems Engineering ASE2000 V2 Communications Test Set
Applied Systems Engineering ASE2000 V2 Communications Test Set (bundled Apache log4net component)
CVE-2018-4063
CVE-2018-4063: Sierra Wireless AirLink ES450/GX450 upload.cgi RCE (KEV, EoL)
Sierra Wireless AirLink ES450 / GX450 (ALEOS firmware)
CVE-2018-5475
CVE-2018-5475: GE D60 Line Distance Relay Stack-Based Buffer Overflow (Remote Code Execution on a Transmission-Line Protection Relay)
GE D60 Line Distance Relay
CVE-2018-9279
CVE-2018-9279: Eaton 9PX UPS Cleartext Password Disclosure
Eaton 9PX UPS firmware (web management interface)
CVE-2019-11001
CVE-2019-11001: Reolink Multiple IP Cameras TestEmail OS Command Injection (KEV)
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W and RLC-511W IP camera firmware ('TestEmail' diagnostic function)
CVE-2019-11043
CVE-2019-11043: PHP-FPM Buffer Overflow (KEV) Bundled in All-Line Equipment Fuel-Boss Fuel Management System
All-Line Equipment Company Fuel-Boss V1 (Standard, Portal, Master/Slave, Backflush) fuel management system
CVE-2019-13524
CVE-2019-13524: GE/Emerson PACSystems RX3i Remote Denial-of-Service via Crafted Packets
GE/Emerson PACSystems RX3i CPE100, CPE115, CPE302, CPE305, CPE310, CPE330, CPE400, CPL410 and CRU320 CPU modules
CVE-2019-16261
CVE-2019-16261: Tripp Lite PDU/UPS Unauthenticated Outlet Control
Tripp Lite PDUMH15AT PDU / SU750XL UPS firmware (web management forms)
CVE-2019-7256
CVE-2019-7256: Nice (formerly Nortek) Linear eMerge E3-Series Access Controller OS Command Injection
Linear eMerge E3-Series building access-control panel (branded Nortek Security & Control at disclosure in 2019, now sold as Nice Linear eMerge E3-Series after Nice Ltd.'s acquisition of the Linear product line); NVD's CPE data names the Essential and Elite firmware variants specifically
CVE-2019-7593
CVE-2019-7593: Johnson Controls Metasys Shared RSA Key Pair (Building Automation)
Johnson Controls Metasys System (ADS/ADX servers and NAE/NIE/NCE engines)
CVE-2020-12493
CVE-2020-12493: SWARCO CPU LS4000 Debug Port Grants Unauthenticated Root Access (Traffic Signal Controller)
SWARCO CPU LS4000 Series traffic signal controller
Full advisory index, by year
Every advisory SoftWSP has published, newest year first — a complete archive, not just the page of results shown above. Pick a CVE below or use the search and filters to narrow by severity, vendor or CWE.
2026
- CVE-2026-0322: Palo Alto Networks PAN-OS management-interface RCE (KEV)
- CVE-2026-102764: BeyondTrust Remote Support Bypass (KEV)
- CVE-2026-104286: Fortinet FortiMail Path Traversal RCE (KEV)
- CVE-2026-104935: Ivanti Connect Secure Authentication Bypass RCE (KEV)
- CVE-2026-10520: Ivanti Sentry OS Command Injection RCE (KEV)
- CVE-2026-114625: Arista VeloCloud Orchestrator SQLi (KEV)
- CVE-2026-15409: SonicWall SMA1000 SSRF (KEV, CVSS 10.0)
- CVE-2026-15410: SonicWall SMA1000 Post-Auth Code Injection to Root Commands (KEV)
- CVE-2026-16232: Check Point SmartConsole Authentication Bypass to Admin Takeover (KEV, Exploited)
- CVE-2026-16812: Arista VeloCloud Orchestrator OS Command Injection (KEV)
- CVE-2026-19490: Citrix NetScaler ADC/Gateway Authentication Bypass
- CVE-2026-20079: Cisco Secure FMC Authentication Bypass to Root RCE
- CVE-2026-20182: Cisco Catalyst SD-WAN Controller Auth Bypass (KEV)
- CVE-2026-20230: Cisco Unified Communications Manager SSRF (KEV, Actively Exploited)
- CVE-2026-20245: Cisco Catalyst SD-WAN Manager Root Privilege Escalation (KEV)
- CVE-2026-20316: Cisco Secure FMC Static Credential Login (KEV, ransomware)
- CVE-2026-20349: Cisco Secure Firewall ASA/FTD Remote Access VPN DoS (KEV)
- CVE-2026-22769: Dell RecoverPoint for VMs Hard-Coded Credential RCE
- CVE-2026-24858: Fortinet FortiCloud SSO Cross-Device Authentication Bypass (KEV, Exploited)
- CVE-2026-25108: Soliton Systems FileZen OS Command Injection (KEV)
- CVE-2026-25994: PJSIP PJNATH ICE Session Buffer Overflow via Long ICE Usernames
- CVE-2026-34909: Ubiquiti UniFi OS Path Traversal (KEV, CVSS 10.0)
- CVE-2026-3503: wolfSSL Post-Quantum Crypto Fault Injection on ARM Cortex-M
- CVE-2026-3611: Honeywell IQ4 Series BMS Controller Auth Bypass
- CVE-2026-46300: Linux Kernel skb_try_coalesce() Shared-Fragment Flaw
- CVE-2026-46728: Das U-Boot FIT Image Signature Verification Bypass via Hashed-Nodes Omission
- CVE-2026-50751: Check Point Security Gateway IKEv1 Auth Bypass (KEV)
- CVE-2026-58704: Google Pixel Cellular Modem Privilege Escalation (KEV)
- CVE-2026-60007: Eclipse Milo OPC UA Padding-Oracle Credential Theft
- CVE-2026-62927: Eclipse Milo OPC UA Authorization Bypass
- CVE-2026-65130: NVIDIA Infrastructure Controller OS Command Injection
- CVE-2026-6653: Hitachi Energy RTU500 libxml2 Use-After-Free
- CVE-2026-67277: MikroTik RouterOS Bandwidth-Test Kernel Memory Disclosure
- CVE-2026-67279: MikroTik RouterOS SSH Auth Bypass (KEV)
- CVE-2026-6866: Schneider EcoStruxure Panel Server Creds
- CVE-2026-7273: Zyxel GS1900 Switch CGI Buffer Overflow RCE
- CVE-2026-7473: Arista EOS Tunnel Decapsulation Spoofing (KEV)
- CVE-2026-76418: Cisco Secure Firewall ASA/FTD SSL VPN Reload DoS (KEV, Exploited)
- CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass (KEV)
- CVE-2026-76461: Cisco Secure Email Gateway SQL Injection to Root RCE (KEV)
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Auth Bypass (KEV)
- CVE-2026-76519: Cisco Secure Email Gateway RCE
- CVE-2026-8037: Progress Kemp LoadMaster Unauthenticated OS Command Injection RCE
- CVE-2026-81535: wolfSSH Unauthorized Forwarded-TCPIP Channel Opens
- CVE-2026-83548: SonicWall SMA1000 Pre-Auth SSRF (KEV)
- CVE-2026-83549: SonicWall SMA1000 Post-Auth OS Command Injection (KEV)
- CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Overflow (KEV)
- CVE-2026-85079: Silicon Labs EmberZNet Zigbee Out-of-Bounds Write RCE
- CVE-2026-85102: Check Point Quantum Gateway/Spark VPN Cert-Validation RCE (KEV)
- CVE-2026-86060: MikroTik RouterOS SSH Privilege Escalation (KEV, "MikroTrick")
- CVE-2026-87659: Brocade Fabric OS Inband Management Authorization Bypass
- CVE-2026-88771: Citrix NetScaler ADC/Gateway Unauthenticated Command Execution (KEV)
- CVE-2026-88772: Citrix NetScaler ADC/Gateway DTLS Pre-Auth Memory Overflow (KEV)
- CVE-2026-88779: Citrix NetScaler ADC/Gateway Memory Buffer DoS (KEV)
- CVE-2026-93616: Check Point Security Management Pre-Auth RCE (KEV)
- CVE-2026-93952: Arista VeloCloud Orchestrator Flaw (KEV)
- CVE-2026-94127: F5 BIG-IP APM OAuth Heap Overflow RCE (KEV)
- CVE-2026-9586: Sangoma Switchvox Unauthenticated SQLi to RCE (KEV)
- CVE-2026-9853: Hitachi Energy MicroSCADA Auth Bypass
2025
- CVE-2025-0282: Ivanti Connect Secure Stack-Based Buffer Overflow RCE
- CVE-2025-0361: Axis Communications VAPIX Device Configuration SSH Management API Username Enumeration
- CVE-2025-14733: WatchGuard Firebox iked IKEv2 RCE (KEV, Known Ransomware Use)
- CVE-2025-14849: Advantech WebAccess/SCADA Unrestricted File Upload RCE
- CVE-2025-25249: Fortinet FortiOS/FortiSwitchManager/FortiSASE Heap Overflow RCE
- CVE-2025-26350: Q-Free MaxTime Unrestricted File Upload (Traffic Signal Controller)
- CVE-2025-26378: Q-Free MaxTime Missing Authorization Enables Admin Password Reset (Traffic Signal Controller)
- CVE-2025-29635: D-Link DIR-823X Command Injection, Active Mirai Exploitation (KEV)
- CVE-2025-32433: Erlang/OTP SSH Server Unauthenticated RCE, CVSS 10.0 (KEV)
- CVE-2025-32975: Quest KACE SMA SSO Authentication Bypass to Admin Takeover (KEV)
- CVE-2025-34468: libcoap Stack-Based Buffer Overflow in Hostname Address Resolution
- CVE-2025-36745: SolarEdge SE3680H Inverter Outdated Linux Kernel Local Exploitation
- CVE-2025-36752: Growatt ShineLan-X Communication Dongle Undocumented Backdoor Account
- CVE-2025-37164: HPE OneView Unauthenticated Code Injection RCE
- CVE-2025-39682: Linux Kernel TLS Zero-Length Record Handling Flaw (KEV)
- CVE-2025-48769: Apache NuttX RTOS Use-After-Free in Filesystem Rename (fs_rename)
- CVE-2025-48965: Mbed TLS ASN.1 Named-Data NULL Pointer Dereference via Crafted Certificate Strings
- CVE-2025-5086: Dassault DELMIA Apriso RCE (KEV)
- CVE-2025-52601: Hanwha Vision IP Camera Firmware Hardcoded Encryption Key
- CVE-2025-53521: F5 BIG-IP APM Stack Buffer Overflow RCE (KEV, Reclassified from DoS)
- CVE-2025-59689: Libraesva Email Security Gateway Compressed-Attachment Command Injection (KEV)
- CVE-2025-61624: Fortinet FortiOS/FortiProxy/FortiPAM CLI Path Traversal (KEV)
- CVE-2025-66644: Array Networks ArrayOS AG DesktopDirect Command Injection (KEV, Exploited)
- CVE-2025-6965: SQLite Aggregate-Term Truncation Reaches Siemens RUGGEDCOM CROSSBOW SAC
2024
- CVE-2024-0012: PAN-OS Management Interface Bypass
- CVE-2024-11667: Zyxel Firewall Path Traversal (KEV)
- CVE-2024-12987: DrayTek Vigor Router Unauthenticated OS Command Injection
- CVE-2024-21762: Fortinet FortiOS SSL-VPN RCE
- CVE-2024-21887: Ivanti Connect Secure command injection
- CVE-2024-21893: Ivanti Connect Secure SSRF
- CVE-2024-23957: Autel MaxiCharger AC Elite Business C50 DLB Stack Overflow RCE
- CVE-2024-27130: QNAP QTS and QuTS hero NAS Buffer Overflow Remote Code Execution
- CVE-2024-3400: PAN-OS GlobalProtect command injection
- CVE-2024-3850: Uniview NVR301-04S2-P4 Network Video Recorder Reflected XSS
- CVE-2024-47575: FortiManager Missing Authentication
- CVE-2024-54085: AMI MegaRAC SPx Redfish Authentication Bypass (KEV)
- CVE-2024-6047: GeoVision EOL Device OS Command Injection (KEV, Mirai Botnet)
- CVE-2024-7490: Microchip Advanced Software Framework tinydhcp Server Stack Overflow (RCE)
2023
- CVE-2023-0451: Econolite EOS Traffic Signal Controller Unauthenticated Credential-File Access
- CVE-2023-0452: Econolite EOS Weak Credential Hashing (Roadway Traffic Signal Controller)
- CVE-2023-0808: Deye/revolt/Bosswerk Micro-Inverter Hard-Coded Wi-Fi Access-Point Password
- CVE-2023-0811: Omron SYSMAC CJ1M PLC UM-Password Memory-Protection Bypass
- CVE-2023-0888: B. Braun Battery Pack SP with Wi-Fi Code-Injection Flaw Grants Root Access to an Infusion-Pump Communication Module
- CVE-2023-1389: TP-Link Archer AX21 Command Injection
- CVE-2023-20078: Cisco IP Phone 6800, 7800 and 8800 Series Web UI Root-Privilege Command Injection
- CVE-2023-20198: Cisco IOS XE Web UI privilege escalation
- CVE-2023-2265: Schweitzer Engineering Laboratories SEL-411L Clickjacking (Protection-Relay Web HMI UI-Redress Attack)
- CVE-2023-22955: AudioCodes 400HD Series VoIP Desk Phones Checksum-Only Firmware Validation
- CVE-2023-2573: Advantech EKI-1500 Series Serial Device Server Authenticated Command Injection
- CVE-2023-27997: FortiOS SSL-VPN Heap Overflow
- CVE-2023-38950: ZKTeco BioTime Unauthenticated Path Traversal
- CVE-2023-39509: Bosch IP Camera Authenticated OS Command Injection
- CVE-2023-40151: Red Lion SixTRAK/VersaTRAK RTU Authentication-Challenge Bypass over TCP (Water/Wastewater Telemetry)
- CVE-2023-4346: KNX Connection Authorization Account-Lockout DoS
- CVE-2023-43959: Yealink SIP-T19P-E2 IP Phone Authenticated Command Injection via Ping Diagnostic
- CVE-2023-46604: Apache ActiveMQ OpenWire RCE, Embedded in Armatura One (KEV, Ransomware)
- CVE-2023-46805: Ivanti Connect Secure Auth Bypass
- CVE-2023-4863: libwebp Heap Buffer Overflow Bundled in Mitsubishi Electric GENESIS64/ICONICS Suite
- CVE-2023-49226: Peplink Balance Two Admin Console Traceroute Command Injection
- CVE-2023-4957: Zebra ZT410 Industrial Label Printer Web Admin Authentication Bypass
- CVE-2023-4966 (Citrix Bleed): NetScaler session hijack
- CVE-2023-6448: Unitronics Vision/Samba PLC & HMI Default Password Takeover (KEV, Water Sector Attacks)
2022
- CVE-2022-1019: Automated Logic WebCTRL Server Open Redirect (Carrier BMS)
- CVE-2022-2107: MiCODUS MV720 GPS Vehicle Tracker Hard-Coded Master Password
- CVE-2022-22722: Schneider Electric Easergy P5 Hard-Coded SSH Key (Substation Protection Relay Credential Exposure)
- CVE-2022-24673: Canon imageCLASS MF644Cdw Unauthenticated SLP Buffer Overflow Remote Code Execution
- CVE-2022-2502: Hitachi Energy RTU500 Series IEC 60870-5-104 Buffer Overflow (Substation RTU Denial of Service)
- CVE-2022-29499: Mitel MiVoice Connect Service Appliance Remote Code Execution (KEV, Actively Exploited)
- CVE-2022-29834: Mitsubishi Electric GENESIS64 / ICONICS Suite Mobile-Monitoring Path Traversal (Water/Wastewater SCADA-HMI)
- CVE-2022-3181: Trihedral VTScada Malformed-HTTP-Request Denial of Service (Water/Wastewater SCADA)
- CVE-2022-32765: Robustel R1510 Industrial Cellular VPN Router sysupgrade OS Command Injection
2021
- CVE-2021-22659: Rockwell MicroLogix 1400 Remote Modbus Buffer Overflow Denial-of-Service
- CVE-2021-22681: Rockwell Logix Controller Key Bypass
- CVE-2021-22707: Schneider Electric EVlink EV Charger Hard-Coded Credentials Authentication Bypass
- CVE-2021-32974: Moxa NPort IAW5000A-I/O Serial Device Server Unauthenticated OS Command Injection
- CVE-2021-32998: FANUC R-30iA/R-30iB Robot Controller Remote Code Execution
- CVE-2021-33016: KUKA KR C4 Robot Controller Hard-Coded Credentials
- CVE-2021-33044: Dahua IP Camera, NVR and Video Intercom Authentication Bypass (KEV)
- CVE-2021-36369: Dropbear SSH Client Authentication-Method Downgrade Bypasses FIDO2/SSH-Askpass
2020
2019
- CVE-2019-11001: Reolink Multiple IP Cameras TestEmail OS Command Injection (KEV)
- CVE-2019-11043: PHP-FPM Buffer Overflow (KEV) Bundled in All-Line Equipment Fuel-Boss Fuel Management System
- CVE-2019-13524: GE/Emerson PACSystems RX3i Remote Denial-of-Service via Crafted Packets
- CVE-2019-16261: Tripp Lite PDU/UPS Unauthenticated Outlet Control
- CVE-2019-7256: Nice (formerly Nortek) Linear eMerge E3-Series Access Controller OS Command Injection
- CVE-2019-7593: Johnson Controls Metasys Shared RSA Key Pair (Building Automation)
2018
- CVE-2018-1000500: BusyBox wget Missing SSL Certificate Validation
- CVE-2018-10635: Universal Robots CB 3.1 Controller Unauthenticated URScript Code Execution
- CVE-2018-11462: Siemens SINUMERIK CNC Controller Remote Privilege Escalation
- CVE-2018-1285: Apache log4net XXE Bundled in Applied Systems Engineering ASE2000 V2 Communications Test Set
- CVE-2018-4063: Sierra Wireless AirLink ES450/GX450 upload.cgi RCE (KEV, EoL)
- CVE-2018-5475: GE D60 Line Distance Relay Stack-Based Buffer Overflow (Remote Code Execution on a Transmission-Line Protection Relay)
- CVE-2018-9279: Eaton 9PX UPS Cleartext Password Disclosure
2017
- CVE-2017-16241: AMAG Symmetry Door Edge Network Controller Unauthenticated Lock/Unlock Command Injection
- CVE-2017-20235: ProSoft Technology ICX35-HWC Cellular Gateway Authentication Bypass (Water/Wastewater Remote Telemetry)
- CVE-2017-2780: InsideSecure MatrixSSL X.509 Certificate Parsing Heap Buffer Overflow
- CVE-2017-7921: Hikvision IP Camera Improper Authentication Bypass (KEV)
2015
2014
Fix guides for the weakness classes behind these CVEs
Each advisory links to the guide for its weakness class. The guides show device and firmware teams how to detect, fix, verify and disclose that class across a product line, not one CVE at a time.
How to fix authentication bypass in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose authentication bypass and missing authentication (CWE-287/CWE-306 and related CWEs) in embedded products, sourced to MITRE CWE.
Updated
How to fix command injection in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose OS command injection (CWE-77/CWE-78) in embedded products, sourced to MITRE CWE and OWASP.
Updated
How to fix hard-coded credentials in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose hard-coded passwords and keys (CWE-798/CWE-259) in embedded products, sourced to MITRE CWE and CISA.
Updated
How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose SQL injection (CWE-89), cross-site scripting (CWE-79), resource exhaustion (CWE-400) and insecure deserialization (CWE-502) in embedded web UIs and management APIs, sourced to MITRE CWE and OWASP.
Updated
How to fix memory corruption in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose memory-corruption bugs (CWE-787/CWE-120 and related out-of-bounds, overflow and use-after-free CWEs) in embedded products, sourced to MITRE CWE and CISA.
Updated
How to fix path traversal in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose path traversal (CWE-22 and related CWEs) in embedded web UIs and file-handling code, sourced to MITRE CWE.
Updated
How to fix weak cryptography in embedded firmware
Practical steps for device and firmware teams to detect, fix and verify broken ciphers, inadequate key strength, hard-coded keys and weak random number generation (CWE-327/326/321/330) in embedded products, sourced to MITRE CWE and CISA.
Updated
Firmware vulnerabilities & fixes
OWASP Firmware Security Testing Methodology (FSTM), explained
OWASP's nine-stage Firmware Security Testing Methodology (FSTM) — obtaining and extracting firmware, static and dynamic analysis, emulation and exploitation — plus how it fits with OWASP's ISTG and ISVS.
Updated
Find out which of these CVEs are in your products or plant
Device firmware security: find the problems, then fix them
Firmware scan, SBOM and vulnerability report for device makers and brands, with optional remediation, maintenance and monitoring.
OT Snapshot: see what is really on your shop-floor network
Record shop-floor traffic from a mirror port, upload it, and receive a device inventory, vulnerabilities and a map of remote access.
Questions about this page?