Firmware Update (Device)
Also known as: firmware, BIOS update, UEFI update, device software update, OTA update, router firmware
Firmware is software stored permanently in a device's non-volatile memory (flash storage) that controls the hardware's basic functions: the lowest layer of software between hardware and operating system or user applications.
Firmware runs in routers, printers, smart TVs, IoT sensors, network switches, hard drives, SSDs, cameras, and virtually every other computerized device. Firmware updates replace this embedded software with a newer version to fix bugs, patch security vulnerabilities, improve performance, or add new features. Unlike software updates (which modify application code), firmware updates modify the core control code for the hardware itself: a failed or interrupted firmware update can render a device inoperable.
Firmware Update (Device), explained at three levels
At home
Firmware is the built-in software that tells your device's hardware how to work: it's like the device's brain at the lowest level. Your home router has firmware; your printer has firmware; your smart TV has firmware; even your hard drive has firmware. Firmware updates are like updates to this built-in brain: they fix problems (bugs), patch security holes (so hackers can't exploit your devices), and sometimes add new features. Unlike updating an app on your phone, firmware updates are more critical and riskier: if a firmware update fails partway through, the device can stop working entirely until it's repaired. Always update firmware for security-critical devices like routers.
At work
Firmware updates are a critical and often neglected part of IT security. Routers, network switches, firewalls, wireless access points, printers, IP cameras, and smart building systems all run firmware, and outdated firmware on these devices is a common attack vector. Many high-profile breaches have exploited known vulnerabilities in unpatched network device firmware. Enterprise network device management should include firmware version tracking and a defined patching schedule. The challenge: unlike operating systems (which typically auto-update) and applications (managed by software distribution tools), firmware on network and IoT devices often requires manual update processes or separate management platforms.
At home
OTA (Over-the-Air) vs. manual firmware updates: modern consumer IoT devices (smart thermostats, doorbells, security cameras, smart speakers) typically use OTA firmware updates: the device checks for updates automatically, downloads them, and applies them (often overnight) without user intervention. Enterprise and industrial devices more often use manual update processes: downloading firmware files from manufacturer websites and applying them through device web interfaces or management consoles. OTA updates improve security posture by ensuring devices stay current, but they can also introduce unintended behaviour changes: some network administrators disable OTA updates on critical infrastructure to maintain firmware version control, accepting the security tradeoff in exchange for change management control.
At work
SSD and NVMe drive firmware: storage device firmware controls how the drive's controller manages NAND flash: wear leveling (distributing writes to prevent early failure of heavily-used cells), bad block management (remapping failed cells to spare capacity), garbage collection (reclaiming erased cells for future writes), and the overall performance characteristics of the drive. Drive manufacturers periodically release firmware updates that fix bugs (some bugs cause data loss or corruption under specific conditions), improve performance, and extend device reliability. Enterprise NVMe SSDs have formalized firmware management as part of storage infrastructure management; consumer drives are less frequently updated but manufacturers do release critical fixes that users should apply.
At home
UEFI/BIOS firmware security: the PC firmware that initializes hardware before the operating system boots (BIOS or modern UEFI) has become a high-value attack target. Firmware-level malware (bootkits) persists through OS reinstallation (because it lives in firmware, not the OS) and can survive even drive replacement. UEFI Secure Boot (cryptographically verifying that only trusted OS loaders can run) and Intel Boot Guard (hardware verification of UEFI firmware integrity) address this. Periodic UEFI/BIOS firmware updates from PC manufacturers patch vulnerabilities (BootHole, LogoFAIL, and other firmware-level vulnerabilities discovered by security researchers). UEFI firmware updates are critical security patches that are often neglected because they are separate from OS updates.
At work
Firmware supply chain attacks: SolarWinds (2020) was a supply chain attack on software; firmware supply chains represent an analogous risk. If an attacker can compromise a firmware update server or signing key, they can distribute malicious firmware to all devices that use that server for updates. Cisco, Juniper, and Fortinet have all disclosed incidents involving compromised or vulnerable firmware. Hardware attestation (cryptographic verification that firmware is unmodified from the manufacturer's signed version) using Trusted Platform Module (TPM) chips or vendor-specific secure enclaves addresses this risk. NIST's Platform Firmware Resiliency Guidelines (SP 800-193) defines requirements for firmware protection, detection, and recovery in federal systems, which many enterprises use as a baseline.
Real-world examples
At home
Thomas noticed his home router had been running the same firmware for 3 years. He logged into the router's web interface and found 8 firmware updates had been released since his version, including 3 marked 'Critical Security Update.' He downloaded the latest firmware directly from the manufacturer's website (not third-party sites) and applied the update through the router interface. The process took 5 minutes and the router rebooted automatically. His router was now on the latest firmware, with the known security vulnerabilities (CVEs) fixed in those updates patched.
At work
Lena managed network infrastructure for a mid-sized company. A security audit identified that 40% of network switches and access points were running firmware versions over 2 years old with known high-severity vulnerabilities. She implemented a quarterly firmware review process: using the network management system to report all device firmware versions, comparing against current manufacturer releases, and scheduling maintenance windows for updates. She also enabled automatic notification from manufacturer security advisories for all network device brands. Within 6 months, all critical and high-severity firmware vulnerabilities were patched, reducing attack surface significantly.
Common confusions
- Many people confuse firmware updates with software/OS updates and assume updating the operating system on a device covers everything — Firmware and operating system software are separate layers. Updating Windows or iOS on a device does not update the firmware of attached peripherals (printer, monitor, webcam), networking equipment (router, switch, access point), storage devices (SSD, NAS), or the device's own BIOS/UEFI. Each of these has separate firmware that must be updated through its own process. A fully patched Windows 11 installation on a laptop with outdated UEFI firmware, an outdated router, and an outdated network switch has significant unpatched vulnerabilities that OS updates cannot address.
- Some assume that downloading firmware from third-party sites is equivalent to downloading from the manufacturer and can be done if the manufacturer's site is unavailable — Firmware downloaded from third-party sites may be modified, outdated, or malicious: this is how many IoT devices are compromised with malicious firmware presented as legitimate updates. Manufacturer firmware is digitally signed; proper firmware update processes verify the signature before applying. Third-party firmware repositories lack this verification chain. Always obtain firmware directly from the device manufacturer's official support or download pages, verify checksums (SHA-256 hashes) where provided, and never apply firmware from unofficial sources regardless of how official they appear. If manufacturer firmware is unavailable (product discontinued), contact the manufacturer rather than turning to third-party sources.
For analysts
Firmware management is a security gap that appears in nearly every technical security assessment and penetration test report for organizations with network infrastructure. The advisory framework: inventory all network-connected devices (not just servers and workstations: routers, switches, access points, printers, IP cameras, smart building systems); track current firmware versions against available updates and CVE databases; establish a firmware patching schedule with defined critical/high SLA targets; and implement manufacturer security advisory subscriptions for all device categories. The ROI on firmware management programs is high: network device vulnerabilities are a primary initial access vector for ransomware and breaches, and firmware patching closes known vulnerabilities at low operational cost.
History & origin
The term 'firmware' was coined in 1967 to describe software stored in ROM (Read-Only Memory) that occupied a middle position between 'hard' hardware and 'soft' software. Early firmware was truly read-only (burned into chips, never updated); the shift to EEPROM and flash storage in the 1980s-1990s enabled firmware to be updated in the field. The rise of internet-connected devices (routers, IP cameras, smart appliances) dramatically increased the importance of firmware security: these devices run continuously, are often forgotten after deployment, and frequently run outdated firmware with known security vulnerabilities. Mirai (2016) was a botnet that compromised hundreds of thousands of IoT devices (primarily IP cameras and DVRs) with default passwords and unpatched firmware vulnerabilities to launch record-breaking DDoS attacks. The incident highlighted that firmware security in internet-connected devices is a critical infrastructure issue. OTA (Over-the-Air) firmware updates (where devices update automatically without user intervention) have become standard for consumer IoT devices (Amazon Echo, Nest, Ring) to ensure security patches are applied without relying on user action.