Firmware Not Updateable
This vulnerability occurs when a hardware product lacks a mechanism for users to install firmware updates, leaving known security flaws permanently unpatched.
When firmware cannot be updated, every security vulnerability discovered after manufacture becomes a permanent, unfixable flaw in the device. This exposes users to potential exploitation for the entire lifespan of the product—which could span decades—effectively locking in security risks. While network-level protections or monitoring can offer some external mitigation, they cannot address the core vulnerability within the device itself. This limitation places the long-term security burden entirely on the user and highlights a critical design failure in the product's lifecycle management.
Impact: Gain Privileges or Assume IdentityBypass Protection MechanismExecute Unauthorized Code or CommandsDoS: Crash, Exit, or Restart
If an attacker can identify an exploitable vulnerability in one device that has no means of patching, the attack may be used against an entire class of devices.
ID : DX-145
A refrigerator has an Internet interface for the official purpose of alerting the manufacturer when that refrigerator detects a fault. Because the device is attached to the Internet, the refrigerator is a target for hackers who may wish to use the device other potentially more nefarious purposes.Code Example:
The refrigerator has no means of patching and is hacked becoming a spewer of email spam.
Code Example:
The device automatically patches itself and provides considerable more protection against being hacked.