Threat actors will frequently target device components, like firmware, that have already known vulnerabilities instead of expending the effort to discover new ones. If a device cannot update its firmware, especially upon the discovery of a vulnerability, threat actors may be able to target these vulnerabilities. This is because a vulnerability that is found once will be exploitable on all devices running that firmware in perpetuity. Threat actors’ ability to achieve their goals will depend on the nature of the unpatched vulnerability. If identified threats cannot be mitigated due to the inability to disable or update vulnerable components, the device will remain vulnerable. This may also be the result of the device reaching its End-of-Service/Support date, where it is no longer being supported by the vendor.

• CWE-1277: Firmware Not Updateable
• CWE-1329: Reliance on Component That is Not Updateable