Technical briefings
Primary-source analysis on embedded Linux, firmware security, and EU product regulation for device manufacturers.
12 selected briefingsSubscribe via Atom feed
OpenSSL has published Git commits for five low-severity vulnerabilities ahead of its 1 December point releases. Four of the five do not affect OpenSSL 3.0, while the fifth reaches only specific CMS encryption paths.
Read the briefingIn focus
An OpenSSH password authentication bypass affecting certain musl-based Linux configurations is listed in CISA’s KEV catalog. Assessing exposure requires reviewing build settings, account configuration, and daemon restarts.
Joint guidance from CISA, the NSA, and Australia’s cybersecurity agency helps buyers assess vendors’ plans for post-quantum cryptography, including support for long-lived industrial and IoT devices.
ENISA, the European Commission, Europol, and national CSIRTs report ongoing compromises of internet-exposed refrigeration controllers across Europe and remind manufacturers of mandatory CRA reporting.
A use-after-free vulnerability in HTTP/2 uploads can allow remote code execution under specific conditions. Assessing its impact requires checking the firmware’s build configuration, enabled features, and applied patches.
An updated RouterOS advisory asks some customers to upgrade again after an incomplete security fix. The correction highlights the importance of testing whether a patch fully resolves a vulnerability.
ENISA’s Single Reporting Platform is operational. Manufacturers may need to submit an initial notification within 24 hours, while the investigation and firmware repair are still in progress.
CIP’s anniversary review describes the security backports, configuration-specific vulnerability assessments, and hardware testing needed to maintain selected industrial Linux kernels into the 2030s.
Final joint guidance updates the minimum elements for a software bill of materials. Firmware teams should review their inventories and ensure each one describes the exact image they maintain.
The European Commission’s guidance covers open-source software, substantial modifications, support periods, and reporting. It includes 67 practical examples to help manufacturers understand how the rules apply.
Wrynose offers support until April 2030 and changes how SBOM and CVE information is generated. Manufacturers need to update their build and reporting tools as part of the migration.
OpenWrt 25.12 replaces opkg with apk and includes tools for attended firmware upgrades. The transition also requires a review of provisioning scripts, saved settings, and configuration migration.
Each technical briefing pairs primary-source references with Firmdura’s engineering analysis for device manufacturers. Listing dates reflect the upstream announcement or advisory update; source review dates are recorded in each briefing.