Typical severity: High. Likelihood of attack: Medium. An adversary may exploit vulnerable code (i.e., firmware or ROM) that is unpatchable. Unpatchable devices exist due to manufacturers intentionally or inadvertently designing devices incapable of updating their software. Additionally, with updatable devices, the manufacturer may decide not to support the device and stop making updates to their software.
Design systems and products with the ability to patch firmware or ROM code after deployment to fix vulnerabilities. | Make use of OTA (Over-the-air) updates so that firmware can be patched remotely either through manual or automatic means