FirmPilot: Evidence-Driven Validation of Vulnerability Reports in Linux-Based IoT Firmware
Year: 2026
Type: article
Abstract: Firmware vulnerability discovery does not necessarily produce an executable proof of concept (PoC). Dynamic techniques, such as rehosting and greybox fuzzing, can provide strong evidence when they successfully trigger a vulnerability, but they often depend on executable services, faithful device environments, and runtime feedback, all of which can be difficult to obtain reliably for commodity IoT firmware. In contrast, static techniques such as taint analysis and data-flow analysis do not require executing the target program and therefore scale more effectively. However, their outputs are typically limited to source-to-sink reports, which may suffer from over-approximated paths, missing device state, or backend transformations of attacker-controlled inputs. As a result, a practical gap remains between vulnerability discovery and vulnerability validation. To bridge this gap, we present FIRMPILOT, a framework for validating firmware vulnerability reports beyond the single-final-request assumption. Given a firmware image and a reported taint slice, FIRMPILOT sequentially recovers interaction dependencies, request templates, and field semantics. It identifies the prerequisite state and trigger mechanisms required to exercise a vulnerability, correlates frontend and backend logic to construct executable request skeletons, and tracks the semantic evolution of attacker-controlled inputs from their raw form to their final consumed values. Based on this evidence, FIRMPILOT classifies each report as confirmed, rejected, or unresolved. A report is confirmed only when a replayable interaction sequence and sink-level corroborating evidence are both available.
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7213625229