Firmware updates will oftentimes include fixes to security vulnerabilities, meaning that past versions will contain security threats to the devices. If a threat actor can initiate a firmware update on the device, they may be able to “upgrade” to a previous firmware version with known vulnerabilities. By completing an “upgrade” to a version with vulnerabilities, the threat actor could then potentially exploit that device to gain additional access or privileges.

• CWE-1328: Security Version Number Mutable to Older Versions