---
name: network-devices-and-iot
description: "Guides a reviewer through auditing network appliances and IoT/embedded devices for pre-auth and management-plane weaknesses, mapping attack surface and applying the listed weakness patterns."
---

# Network devices and IoT

Routers, VPNs, firewalls and other network appliances, IoT and embedded devices: management interfaces, pre-auth services, firmware, update mechanisms.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 15 newer reports it was not written from: following it finds about 10% of them._

## Reviewing network devices and IoT

**Approach.** Treat every appliance as a small OS with a web UI bolted on. Assume the management plane, pre-auth services, and update path are all reachable by an attacker who has never logged in. Your job is to find where untrusted bytes cross into privileged code before authentication.

**Map first.**
1. Enumerate listening services and which respond *before* login (web, UPnP, mDNS, TR-069, VPN, AT/serial bridges).
2. Trace each pre-auth request to its handler: parser → dispatcher → sink (copy, shell, file, alloc).
3. Inventory firmware/update and config-import paths, and how signatures and TLS are checked.
4. Note device-ID/serial-based endpoints and VPN tunnel routing rules.

**Questions that surface weaknesses.**
- Does any length/offset field from the wire size a copy or advance a pointer without a destination bound?
- Can request, log, or AT-command data reach `system`/`popen`/`eval` before an auth check?
- Is TLS validation skipped, gated on negotiation, or hand-rolled hostname matching that fails open?
- Do user/config names reach file open/write/delete without traversal checks?
- Do pre-auth endpoints read files or leak creds, certs, or session stores?
- Are responses sized by a length field rather than bytes actually written (stale memory)?
- Does fragment reassembly mix keys, keep stale state, or trust plaintext flags/lengths?
- Do peer-declared sizes or compressed data drive allocation/loops without a hard cap?
- Is a device/serial/user ID the *only* authorization for streams, commands, or binding?
- Does the authorizer check a different string (path/header) than the router dispatches on?
- Do VPN local-subnet/server-IP exclusions lack RFC1918 or socket-scope checks, leaking plaintext?

**Using the patterns.** Walk the list against each mapped sink; each names a concrete failure to confirm or rule out. Record where input enters, what check (if any) guards it, and the sink reached. Prioritize pre-auth reachability and anything crossing into shell, file, or fixed buffers.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Trusted length field drives copy
Wire length or offset used as copy size or pointer advance without a bound against the destination

_19 reports · 11 confirmed bounties, median $5,000, up to $105,000._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/unchecked-length-field-copy.md

### Pre-auth input to shell in appliances
Unauthenticated request, log, or AT-command data reaching system/popen/eval before any auth check

_7 reports · one confirmed bounty: $2,000._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/preauth-command-injection.md

### Unbounded allocation and decompression DoS
Peer-declared sizes, counts, compressed data, or per-request state driving memory or loops without a hard cap

_6 reports · 2 confirmed bounties: $500 and $50,000._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/resource-exhaustion-unbounded.md

### Missing or partial TLS validation
TLS checks skipped, gated on negotiation, or reimplemented wildcard/hostname matching that fails open

_5 reports · one confirmed bounty: $2,100._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/tls-cert-validation-missing.md

### Pre-auth file read exposing secrets
Unauthenticated endpoints that read files or expose credentials, certs, or session stores

_4 reports · 2 confirmed bounties: $20,160 and $107,500._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/preauth-file-read-credential-leak.md

### Unbounded copy into fixed buffer
Copies into fixed-size buffers where input length is never checked against destination capacity

_4 reports · one confirmed bounty: $40,000._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/unbounded-input-to-fixed-buffer.md

### Authz path vs handler routing mismatch
Authorizer checks URL path or client header; router dispatches on a different string to a protected handler

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/auth-bypass-routing-mismatch.md

### Unsantized path in file operations
User or config names reaching open/write/delete sinks without traversal checks

_3 reports · one confirmed bounty: $750._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/path-traversal-file-ops.md

### Stale memory returned to client
Length or presence checks that send allocated or uninitialized bytes instead of actual written data

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/uninitialized-memory-disclosure-2.md

### Fragment reassembly trusts unauthenticated flags
Reassembly that mixes fragments across keys, keeps stale state, or trusts plaintext header flags and length fields

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/fragment-reassembly-flaw.md

### Missing ownership check on device access
Device ID, serial, or user ID used as the only authorization for streams, commands, or account binding

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/missing-authorization-object.md

### VPN tunnel exclusion leaks plaintext traffic
Local-subnet or server-IP exclusions from the tunnel that lack RFC1918 or socket-scope checks

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/network-devices-and-iot/vpn-traffic-leak.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **DNS records spoofed or poisoned**: Unverified zones, censored-keyword queries, or shared nameservers return attacker records (https://bugbountylibrary.com/r/blog%3Awiz-io-blog-black-hat-2021-dns-loophole-makes-nation-state-level-spying-as-easy-as-registering-a-domain.md)
- **Rogue RA redirects host traffic**: Raw-socket capability or container can inject IPv6 router advertisements (https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-ipv6-ra-mitm.md)
- **SSRF filter bypass via encoding**: Banned-IP filters bypassed by IPv4-mapped IPv6 or trusted PASV/redirect addresses (https://bugbountylibrary.com/r/h1%3A1785260.md)
- **ALG header rewrite opens pinhole**: SIP or similar ALG trusts attacker Contact headers to open firewall pinholes (https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2020-nat-slipstreaming-simplified.md)
- **Malformed frame reaches assert**: Protocol state machines abort on malformed frames instead of rejecting (https://bugbountylibrary.com/r/h1%3A800140.md)
- **Stale pointer freed or reused**: Packet or mbuf pointers freed then reused after header or length checks (https://bugbountylibrary.com/r/h1%3A943231.md)