# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 6 Discussion  
We devised the vulnerability scanning tool WFinder specifically for embedded web servers. We analyze the correlation between the front end and back end, identify boundary binary files and external data inflow points based on the features of the front end and back end correlation, scan and filter the dangerous functions in the boundary binary files, and finally perform a lightweight taint analysis to identify potential vulnerabilities. WFinder successfully uncovers thirteen zero-day vulnerabilities across ten firmware samples, with eight of them already assigned CNVD identifiers. Our evaluation results indicate that WFinder surpasses the capabilities of cutting-edge tools in identifying errors within the firmware samples.  
\begin{table}
\begin{tabular}{l l l l l l l l l l} \hline \hline  & **Vendor** & **AX1803** & **AX1806** & **G1/G3** & **DIR823G** & **DIR816** & **X2000R** & **A3002R** & **R7000** & **R7000P** \\ \hline WFinder & TP/Alert & 0.68 & 0.56 & 0.49 & 0.55 & 0.57 & 0.43 & 0.40 & 0.53 & 0.59 \\  & Vulnerability/TP & 0.93 & 0.86 & 0.58 & 0.58 & 0.72 & 0.43 & 0.13 & 0.64 & 0.69 \\ \hline SaTC & TP/Alert & 0.66 & 0.73 & 0.58 & 0.67 & 0.5 & 0.76 & 0.45 & 0.81 & 0.50 \\  & Vulnerability/TP & 0.38 & 0.42 & 0.45 & 0.48 & 0.64 & 0.30 & - & 0.41 & 0.57 \\ \hline \hline \end{tabular}
\end{table}
Table 8: The accuracy of the taint analysis. We have listed the proportion of true positives in alarms and the proportion of verified vulnerabilities in true positives for each sample.  
Figure 6: The efficiency of the taint analysis. We have listed the analysis time of each sample for WFFinder and SaTC.  
Future Work: In this study, we implement a preliminary vulnerability-scanning approach crossing the front end and back end. We analyze and observe real firmware programs, summarize the feature recognition of external data entry points in the back end, and design methods to balance efficiency and accuracy in the process of data flow analysis. Due to the balance between accuracy and efficiency, our method can efficiently explore more vulnerabilities, making it highly practical for firmware vulnerability analyses. However, to enhance efficiency during the taint analysis phase, we accepted a certain level of false positives, which can be manually reviewed. Moreover, while WFinder assesses the reachability of paths during the scanning process, it does not account for potential constraints on user inputs along these paths, which is also why some true positives cannot become vulnerabilities. Therefore, future efforts will focus on developing an appropriate automatic verification method to address these issues. We consider extracting relevant information from our static analysis process and combining it with dynamic fuzz testing to achieve the automated verification of potential vulnerabilities and PoC generation.  
Conceptualization: [PERSON] and [PERSON]. ([PERSON]); methodology: [PERSON]; formal analysis: [PERSON] and [PERSON]; resources: [PERSON]. ([PERSON]); writing--original draft preparation: [PERSON]; writing--review and editing: [PERSON] and [PERSON]. ([PERSON]); supervision: [PERSON]. All authors have read and agreed to the published version of the manuscript.  
This research study was funded by National Key Research and Development Program of China, grant number 2019 QY0500.  
Not applicable.  
The data presented in this study are available upon request from the corresponding author. The data are not publicly available due to privacy.  
The authors declare no conflicts of interest.