Connected device flaws: why is firmware visibility still the gap?

TL;DR: Most connected device security flaws trace back to one root problem, makers cannot see what software is inside the device, so default passwords, vulnerable open-source code, and insecure interfaces keep producing breaches and now trigger mandatory SBOM and reporting duties under the EU Cyber Resilience Act, according to Finite State research. Visibility, not perimeter tooling, is the control that determines whether device risk can actually be governed.

Editorial analysis by NHI Mgmt Group, based on content published by Finite State: “Connected Device Security Flaws: What They Are and How to Fix Them”.

Key questions

Q: What breaks when connected devices ship without a trustworthy software inventory?

A: Without a trustworthy inventory, teams cannot tell which flaws are present, which components are reachable, or which products are affected by new disclosures.

Q: Why do default passwords on smart devices create such a big risk?

A: Default passwords are predictable, widely known, and often reused across devices, which makes them easy to guess or automate against.

Q: What signs show that a device programme is still relying on undocumented third-party code?

A: Repeated high-severity findings in embedded libraries, missing component provenance, inability to explain update paths, and dependence on vendor assurances rather than extracted firmware evidence are all warning signs.

Practitioner guidance

• Build a firmware-derived SBOM Extract the shipped image and inventory the actual components present in firmware, not the ones listed in design documentation or build manifests.
• Eliminate default credentials before release Remove universal passwords, disable unnecessary management interfaces, and verify that each device ships with unique or provisioned access controls.
• Use reachability to rank vulnerabilities Prioritise flaws only when the vulnerable component is present in the product and reachable through real execution paths or exposed services.

Bottom line: Connected device flaws persist when manufacturers cannot see the software and firmware they ship.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →