Talk to an engineer

Company · Hamburg, Germany

Independent firmware security engineering in Hamburg.

Firmdura UG (haftungsbeschränkt) is an engineering company built for one discipline: keeping shipped embedded Linux products secure and CRA-compliant across multi-year lifecycles without consuming the platform teams that build them.

Scope of practice

Why Firmdura focuses exclusively on post-release firmware maintenance.

The engineering bottleneck occurs after launch. Industrial gateways, routers, energy systems, and connected equipment stay in service for five to ten years. Over that support period, upstream projects keep publishing security fixes on their latest branches while the manufacturer's Linux branch, kernel, and board support package remain fixed by hardware qualification and ABI stability.

Manufacturers need completed maintenance work, not more alerts. Firmdura operates as a specialized extension of your embedded software group: investigating CVE applicability against your actual build configuration, adapting or backporting fixes, rebuilding and testing candidate firmware in environments you control, and coordinating parallel EU Cyber Resilience Act reporting.

In scope

What Firmdura executes for manufacturers

  • Configuration-aware CVE triage: source, build-definition, compile-flag, and target-architecture verification with auditable VEX and build-metadata records (such as CVE_STATUS or IGNORE_CVES).
  • Patch adaptation & backporting: compatible package updates or semantic backports across diverged branches with upstream commit provenance.
  • Automated build & regression runs: reproducible package and image builds plus baseline-versus-candidate functional checks in customer-approved environments.
  • CRA Article 14 reporting workflows: reportability evaluation, 24-hour / 72-hour notification drafting, and deadline coordination alongside active remediation.
Deliberately out of scope

What we do not sell or require

  • No unverified scanner feeds: we do not hand your team raw CVE lists left for internal engineers to triage from scratch.
  • No platform replacement: we preserve your existing semiconductor vendor, BSP, Linux build system, and deployment infrastructure.
  • No runtime firmware agents: deliverables are standard Git commits, build definitions, and patches with zero proprietary binaries added to your image.
  • No custody of signing keys: production review, cryptographic signing, hardware sign-off, and field deployment remain strictly under your control.

Operating standards

How we work with hardware and platform engineering teams.

Security maintenance touches production firmware and regulated product records. Our operating rules are designed around verifiability, least-privilege access, and clear contractual boundaries.

  • Your platform and repository stay yours

    We work directly with your pinned firmware branch, vendor BSP, and CI workflow. Every package update, backported patch, test harness change, and CVE disposition is committed directly to your repository in standard open formats.

  • Claims bounded by reproducible builds and tests

    We do not treat patch metadata or clean compilation as proof of a working product fix. Every delivery links source provenance, immutable Git revisions, candidate build outputs, and explicit records of what passed and what still requires physical hardware sign-off.

  • Written boundaries before repository access

    Confidentiality, branch scope, and source-handling rules are agreed in writing before work starts. Builds and regression suites execute inside infrastructure you host or explicitly approve.

  • Primary sources separated from interpretation

    Our published technical briefings examine active vulnerabilities, embedded Linux and kernel LTS changes, and EU CRA guidance with direct links to primary advisories and legal texts, keeping reported facts distinct from our engineering analysis.

Jurisdiction & data discipline

German corporate jurisdiction and strict privacy defaults.

Firmdura UG (haftungsbeschränkt) is incorporated in Hamburg, Germany, and provides engineering services exclusively to business customers under German commercial law and the EU General Data Protection Regulation (GDPR).

Consistent with our engineering approach, this website sets no cookies, runs no client-side scripts, loads no external assets, and performs no visitor analytics or profiling.

Provider identification (Imprint) Privacy notice (GDPR)

Engineering enquiries

Discuss a firmware baseline with an engineer.

Whether you are scoping maintenance for a shipped embedded Linux release or planning for EU Cyber Resilience Act vulnerability handling and Article 14 reporting, engagements begin with a direct technical conversation and a fixed-fee baseline scope.

Talk to an engineer Engagement model & pricing