Volume 19 • Issue 1 • PP: 47–66 • 2027
IoT Device Vulnerabilities in the National Vulnerability Database: Latent Attack Profiles, Text-Based Recovery of Unenriched Records and Exploitation Hazards
Open Access & Copyright
© 2027 The Author(s). Published by ASPG. This article is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
View PDF Abstract
Internet of Things (IoT) devices enter the vulnerability record through firmware advisories that are scored, catalogued and enriched by institutions under strain. We separate device CVEs from the rest of the National Vulnerability Database using product enumerations and characterise those published from January 2022 to June 2026 with five models. They are more severe. A quarter are Critical against 13.7% of other CVEs, memory-safety and command-injection flaws each carry an odds ratio above three, and a single router vendor accounts for one device CVE in eight. An expectation–maximisation latent class model finds eight attack profiles. A logistic text classifier trained on enriched records (AUC 0.98), combined with adjusted classify-and-count, recovers device CVEs that NIST never enriched and raises the 2025 count by about a third, although the decline in the device share survives the correction. Topic models are dominated by reporting templates. They also record a rise in end-of-life language, from 0.1% to 4.8% of device CVEs. With severity and weakness held fixed, device CVEs are less likely to reach the Known Exploited Vulnerabilities catalog (hazard ratio 0.61), which suggests that their high scores overstate observed exploitation.
Keywords
References
[1] M. Antonakakis et al., “Understanding the Mirai botnet,” in Proc. 26th USENIX Security Symp., pp. 1093–1110, 2017.
[2] D. Kumar et al., “All things considered: An analysis of IoT devices on home networks,” in Proc. 28th USENIX Security Symp., pp. 1169–1185, 2019.
[3] N. Neshenko, E. Bou-Harb, J. Crichigno, G. Kaddoum, and N. Ghani, “Demystifying IoT security: An exhaus-tive survey on IoT vulnerabilities and a first empirical look on Internet-scale IoT exploitations,” IEEE Com-mun. Surveys Tuts., vol. 21, no. 3, pp. 2702–2733, 2019.
[4] F. Meneghello, M. Calore, D. Zucchetto, M. Polese, and A. Zanella, “IoT: Internet of threats? A survey of practical security vulnerabilities in real IoT devices,” IEEE Internet Things J., vol. 6, no. 5, pp. 8182–8201, 2019.
[5] T. Bakhshi, B. Ghita, and I. Kuzminykh, “A review of IoT firmware vulnerabilities and auditing techniques,” Sensors, vol. 24, no. 2, Art. no. 708, 2024.
[6] European Parliament and Council of the European Union, “Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act),” Official Journal of the European Union, L, 2024/2847, 2024.
[7] European Telecommunications Standards Institute, Cy-ber Security for Consumer Internet of Things: Baseline Requirements, ETSI EN 303 645 V2.1.1, 2020.
[8] M. Fagan, K. N. Megas, K. Scarfone, and M. Smith, Foundational Cybersecurity Activities for IoT Device Manufacturers, NIST Interagency Rep. 8259, 2020.
[9] U.S. Department of Commerce Office of Inspector Gen-eral, Evaluation of NIST’s Management of the National Vulnerability Database, Rep. OIG-26-020-I, 2026.
[10] National Institute of Standards and Technology, “NIST updates NVD operations to address record CVE growth,” news release, Apr. 15, 2026.
[11] A. Costin, J. Zaddach, A. Francillon, and D. Balzarotti, “A large-scale analysis of the security of embedded firmwares,” in Proc. 23rd USENIX Security Symp., pp. 95–110, 2014.
[12] D. D. Chen, M. Woo, D. Brumley, and M. Egele, “To-wards automated dynamic analysis for Linux-based em-bedded firmware,” in Proc. Network and Distributed System Security Symp., 2016.
[13] A. Anwar, A. Abusnaina, S. Chen, F. Li, and D. Mo-haisen, “Cleaning the NVD: Comprehensive quality assessment, improvements, and analyses,” IEEE Trans. Dependable Secure Comput., vol. 19, no. 6, pp. 4255–4269, 2022.
[14] T. H. M. Le, H. Chen, and M. A. Babar, “A survey on data-driven software vulnerability assessment and prioritization,” ACM Comput. Surveys, vol. 55, no. 5, Art. no. 100, 2022.
[15] X. Feng, Q. Li, H. Wang, and L. Sun, “Acquisitional rule-based engine for discovering Internet-of-Things devices,” in Proc. 27th USENIX Security Symp., pp. 327–341, 2018.
[16] V. Hassija, V. Chamola, V. Saxena, D. Jain, P. Goyal, and B. Sikdar, “A survey on IoT security: Application areas, security threats, and solution architectures,” IEEE Access, vol. 7, pp. 82721–82743, 2019.
[17] I. Nadir, H. Mahmood, and G. Asadullah, “A taxonomy of IoT firmware security and principal firmware analysis techniques,” Int. J. Critical Infrastructure Protection, vol. 38, Art. no. 100552, 2022.
[18] V. Safronov, A. Bostan, N. Allott, and A. Martin, “How memory-safe is IoT? Assessing the impact of memory-protection solutions for securing wireless gateways,” arXiv:2411.01377, 2024.
[19] Cybersecurity and Infrastructure Security Agency, Bind-ing Operational Directive 22-01: Reducing the Sig-nificant Risk of Known Exploited Vulnerabilities, U.S. Department of Homeland Security, 2021.
[20] Forum of Incident Response and Security Teams, Com-mon Vulnerability Scoring System Version 3.1: Specifi-cation Document, 2019.
[21] P. F. Lazarsfeld and N. W. Henry, Latent Structure Anal-ysis. Boston, MA, USA: Houghton Mifflin, 1968.
[22] L. A. Goodman, “Exploratory latent structure analy-sis using both identifiable and unidentifiable models,” Biometrika, vol. 61, no. 2, pp. 215–231, 1974.
[23] A. P. Dempster, N. M. Laird, and D. B. Rubin, “Max-imum likelihood from incomplete data via the EM al-gorithm,” J. Royal Stat. Soc. B, vol. 39, no. 1, pp. 1–38, 1977.
[24] G. Schwarz, “Estimating the dimension of a model,” Ann. Statistics, vol. 6, no. 2, pp. 461–464, 1978.
[25] K. L. Nylund, T. Asparouhov, and B. O. Muthén, “De-ciding on the number of classes in latent class analysis and growth mixture modeling: A Monte Carlo simula-tion study,” Structural Equation Modeling, vol. 14, no. 4, pp. 535–569, 2007.
[26] G. Salton and C. Buckley, “Term-weighting approaches in automatic text retrieval,” Information Processing & Management, vol. 24, no. 5, pp. 513–523, 1988.
[27] J. C. Platt, “Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods,” in Advances in Large Margin Classifiers, pp. 61–74, 1999.
[28] F. Pedregosa et al., “Scikit-learn: Machine learning in Python,” J. Mach. Learn. Res., vol. 12, pp. 2825–2830, 2011.
[29] G. Forman, “Quantifying counts and costs via classifica-tion,” Data Mining and Knowledge Discovery, vol. 17, no. 2, pp. 164–206, 2008.
[30] P. González, A. Castaño, N. V. Chawla, and J. J. del Coz, “A review on quantification learning,” ACM Comput. Surveys, vol. 50, no. 5, Art. no. 74, 2017.
[31] D. D. Lee and H. S. Seung, “Learning the parts of ob-jects by non-negative matrix factorization,” Nature, vol. 401, no. 6755, pp. 788–791, 1999.
[32] D. D. Lee and H. S. Seung, “Algorithms for non-negative matrix factorization,” in Advances in Neural Information Processing Systems 13, pp. 556–562, 2001.
[33] G. Bouma, “Normalized (pointwise) mutual information in collocation extraction,” in Proc. Biennial GSCL Conf., pp. 31–40, 2009.
[34] M. Röder, A. Both, and A. Hinneburg, “Exploring the space of topic coherence measures,” in Proc. 8th ACM Int. Conf. Web Search and Data Mining, pp. 399–408, 2015.
[35] E. L. Kaplan and P. Meier, “Nonparametric estimation from incomplete observations,” J. Amer. Stat. Assoc., vol. 53, no. 282, pp. 457–481, 1958.
[36] D. R. Cox, “Regression models and life-tables,” J. Royal Stat. Soc. B, vol. 34, no. 2, pp. 187–220, 1972.
[37] C. Davidson-Pilon, “lifelines: Survival analysis in Python,” J. Open Source Softw., vol. 4, no. 40, Art. no. 1317, 2019.
[38] D. A. Williams, “The analysis of binary responses from toxicological experiments involving reproduction and teratogenicity,” Biometrics, vol. 31, no. 4, pp. 949–952, 1975.
[39] B. Efron and C. Morris, “Data analysis using Stein’s estimator and its generalizations,” J. Amer. Stat. Assoc., vol. 70, no. 350, pp. 311–319, 1975.
[40] E. B. Wilson, “Probable inference, the law of succession, and statistical inference,” J. Amer. Stat. Assoc., vol. 22, no. 158, pp. 209–212, 1927.
[41] O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose, “SoK: Security evaluation of home-based IoT deploy-ments,” in Proc. 2019 IEEE Symp. Security and Privacy, pp. 1362–1380, 2019.
[42] J. Jacobs, S. Romanosky, B. Edwards, I. Adjerid, and M. Roytman, “Exploit prediction scoring system (EPSS),” Digital Threats: Research and Practice, vol. 2, no. 3, Art. no. 20, 2021.
Cite This Article
Choose your preferred format
Publisher's Note
The statements, opinions, and data presented in this article are solely those of the author(s) and do not necessarily represent those of ASPG, the journal, or its editors. ASPG and the editors disclaim responsibility for any harm arising from the use of any ideas, methods, instructions, or products described in this article, to the fullest extent permitted by applicable law.