# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 5 Evaluation
### Real-World Vulnerabilities  
As shown in Table 4, WFinder detected 13 previously unknown bugs. These 13 bugs were first discovered by WFinder during the experimental process. We report newly discovered vulnerabilities to the CNVD in a non-public manner, and the CNVD will verify and confirm the vulnerabilities and be responsible for contacting the manufacturer for handling. At the time of writing this paper, 8 of these have been reported to the CNVD and assigned identifier numbers; all 13 are buffer overflow vulnerabilities. The 13 bugs we discovered are all buffer overflow vulnerabilities, including heap overflow and stack overflow. They are all web service programs on the firmware back end which, when processing data packets, obtain the parameter values and flow into dangerous functions without limiting their length, resulting in buffer overflows. We use real devices to verify vulnerabilities, and 13 vulnerabilities can cause DOS or even more harm to the device. In fact, the harm that buffer overflow vulnerabilities can cause is related to the protection mechanisms enabled by binary programs. Due to the limited resources provided by embedded devices, most defense mechanisms will not be enabled. In the firmware we analyzed, most of the firmware programs only enabled NX, while ASLR and canary were hardly enabled. This paper only describes the relevant work of vulnerability discovery, and the discovered vulnerabilities can be triggered through the constructed PoC. Further discussion on vulnerability exploitability analysis will not be conducted. **Comparison with SaTC. ** We compared WFinder with the state-of-the-art static analysis tool SaTC with respect to discovering vulnerabilities. In order to make the comparison fair, we added the danger function defined in SaTC to align it with WFinder. Table 5 shows our evaluation results. WFinder raised a total of 644 alerts, of which 346 were true positives and 225 were verified to be real vulnerabilities. SaTC raised 660 alerts, of which 422 were true positives, but only 183 were verified to be real vulnerabilities. The results indicate that WFinder can identify more vulnerabilities. At the design level, WFinder adopts a similar approach to SaTC, identifying the correlation between the front end and back end to locate \begin{table}
\begin{tabular}{l l l} \hline \hline
**Device Series** & **Total** & **Bug IDs** \\ \hline \multirow{3}{*}{AX1803} & \multirow{3}{*}{8} & CNVD-2022-89238, CNVD-2022-89237, CNVD-2022-03807, \\  & & CNVD-2023-03805, CNVD-2023-03806, CNVD-2023-03807, \\ \cline{1-1}  & & CNVD-2023-03809, CNVD-2023-00833 \\ \hline \hline X2000R & 2 & unassigned \\ \hline AX1806 & 3 & unassigned \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Zero-day discoveries using WFinder. We identified 13 new buffer overflow vulnerabilities; 8 of them were reported to the CNVD and assigned identifier numbers. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Vendor** & **Device Series** & **Architecture** & **SizeP** & **SizeUP** \\ \hline \multirow{3}{*}{Tenda} & AX1803 & ARM & 41.7 MB & 102.7 MB \\  & AX1806 & ARM & 46.8 MB & 114.5 MB \\  & G1/G3 & ARM & 10.4 MB & 62.5 MB \\ \hline \multirow{3}{*}{D-Link} & DIR823G & MIPS & 6.2 MB & 31.8 MB \\  & DIR816 & MIPS & 3.9 MB & 20.5 MB \\ \hline \multirow{3}{*}{ToToLink} & X2000R & MIPS & 12.5 MB & 72.9 MB \\  & A3002R & MIPS & 6.9 MB & 37.5 MB \\ \hline \multirow{3}{*}{Netgear} & R7000 & ARM & 32.3 MB & 192.9 MB \\  & R7000P & ARM & 41.7 MB & 227.2 MB \\ \hline \hline vivotek & CC8160 & ARM & 36.4 MB & 51.7 MB \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Dataset of device samples. We selected 10 device samples from 5 vendors: 9 routers and 1 camera. SizeP and SizeUP represent the averages size before and after unpacking, respectively. the starting point of the taint analysis. However, there are significant differences in the final results. This is because SaTC did not consider that the user input data were introduced by an external input function.