Analyzing 1-Day Vulnerabilities in Embedded Devices: A Threat Modeling and Patching Pattern Study for Router Security

With the expanding application scenarios of IoT devices, hundreds of millions of embedded devices have become an integral part of daily life. However, as the deployment of embedded devices continues to grow, their increasingly prominent security issues have drawn widespread attention. Due to the typically long update cycles of embedded devices, many publicly disclosed 1-day vulnerabilities remain highly exploitableThis study focuses on 1-day vulnerability and security patch discovery for Linux-Based embedded systems. A comprehensive investigation was conducted on 1,699 security advisories released by four leading embedded device manufacturers. The findings reveal that command injection and buffer overflow vulnerabilities pose significant risks in embedded devices. Notably, only 14 of these advisories provided detailed information on the precise locations of the vulnerabilities. To further analyze the security of embedded devices, this study constructs a threat model and performs a systematic security assessment. Through this process, key research targets, potential threats, and their root causes in embedded device security research are identified. Additionally, the study summarizes three common patching patterns for vulnerabilities discovered in embedded device firmware.