Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can check closed-source firmware for known CVEs without its source code, but a scanner result is only a lead until you verify the exact device and firmware, identify the relevant component and version, and establish that the affected code applies to that product. Start with the vendor’s SBOM, security advisories, and VEX statements; inspect a vendor firmware image for component clues if needed; then compare those findings with CVE records and the vendor’s affected-version information.
What counts as a useful firmware CVE check?
A useful check produces a dated, evidence-backed assessment of a particular device configuration—not just a list of CVEs whose version ranges resemble strings found in a firmware file. Identify the manufacturer, exact model, hardware revision, region or variant, and installed firmware version. Then distinguish what is confirmed from what is inferred.
A vendor SBOM (software bill of materials) can identify components and versions. A vendor advisory can define affected and fixed product releases. A VEX statement can explain whether a vulnerability in a listed component affects the product. These sources are generally more informative than a guessed version string because they can account for the way the device was built and configured. CISA’s SBOM guidance discusses using SBOM and VEX information to assess product vulnerability, while the Firmware Embedded SBOM Specification describes firmware inventory details such as component versions and hashes.
If no vendor evidence is available, binary inspection can reveal files and component clues. It cannot, by itself, prove that a CVE affects the device.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to check firmware for CVEs, step by step
1. Pin down the device and firmware image
Record the device manufacturer, exact model, hardware revision, region or variant, installed firmware version, and the date of your assessment. If you are assessing a downloadable image, record its vendor download page or other source and calculate a cryptographic hash, such as SHA-256. The hash lets you and others refer to the same file even if filenames are reused or ambiguous. A filename alone does not establish firmware version or integrity.
Use an image intended for the exact hardware and region where possible. Router product families can have several hardware revisions or regional builds with different contents; a match for one is not automatically evidence about another. The firmware SBOM specification describes component version and hash information useful for identifying inventory items.
2. Search for vendor evidence before extracting binaries
Check the manufacturer’s security page, support page, and release notes using the exact model and firmware version. Look for:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- An SBOM identifying software components and versions.
- A security advisory listing affected and fixed device or firmware versions.
- A VEX statement that says whether a named vulnerability affects the product, is not applicable, has been fixed, or remains under investigation.
Save the document, URL, and date consulted. A supplier’s product-specific determination can resolve questions a component list cannot—for example, whether affected code is present in the particular build. CISA explains how VEX can clarify whether vulnerabilities associated with SBOM components actually affect a product; the firmware specification describes a supplier chain for providing this kind of information.
3. Inspect an available firmware image for component clues
When there is no adequate vendor inventory, inspect a firmware image obtained from a trustworthy source. Binwalk can identify and optionally extract embedded files and data from firmware images. Its results may expose file systems, executables, certificates, and recognizable metadata for further examination.
Treat extraction as an initial inventory step, not as a vulnerability verdict. A detected file or readable string may be incomplete, stale, unrelated to the running system, or insufficient to establish the component’s exact version. Binwalk’s project description does not claim that extraction determines whether each component is vulnerable.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Record the evidence for each possible component
Build a component-and-version record before searching CVEs. Include the image hash and assessment date, then capture a separate row for each clue:
- Component name and any identifier or hash.
- Observed version and whether it came from an SBOM, package metadata, a binary, or a string.
- File path or image offset where the clue appeared.
- Identification confidence and the evidence supporting it.
- Source URL and date for any vendor statement or other authoritative record.
Make the evidence type explicit. “Vendor SBOM lists component version” is different from “version-like string found in a binary.” The Firmware Embedded SBOM Specification describes component identity, version, hashes, vendors, and relationships as useful inventory fields.
5. Compare components with CVE records and product advisories
Search the component name and version in CVE/NVD records, and check the device maker’s security notices for product-specific affected and fixed releases. Compare the exact firmware and hardware configuration against the record’s affected-version details; do not rely only on a matching component name or broad version range. NVD uses CPE as one form of applicability metadata, but a CPE association is not by itself proof that a particular device is exploitable.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For example, an NVD record for CVE-2024-41616 associates the specific D-Link DIR-300 firmware version identified there with the vulnerability. That illustrates a precise product-and-version mapping; it does not establish that every device with a similar product name or every related firmware build is affected. NVD affected-configuration data and presentation can change, so consult the current record and its references. NIST’s NVD status page reported an August 26, 2026 update concerning affected configurations and SSVC presentation.
6. Validate applicability and state what remains uncertain
For each candidate CVE, check whether the affected component and code are present in the target build and whether the affected configuration applies. Look for a vendor VEX or advisory that directly addresses the product. If neither vendor evidence nor the available image resolves applicability, report the result as “candidate match; applicability unconfirmed” and ask the vendor or component supplier for a product-specific determination.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →This distinction matters because a component can appear in an SBOM while the vulnerable code is absent, disabled, unreachable, or otherwise not applicable. NTIA’s SBOM framing guidance cautions that limited signals such as version strings and protocol banners can produce incorrect detections. The firmware specification also notes that the party with the source tree and build configuration may be the only one able to determine whether a particular built binary is affected.
7. Prioritize the confirmed issues in device context
For each finding, consider whether it is confirmed for the exact product, whether exploitation is known, how the device is exposed and used, the severity information, and whether a fixed vendor release exists. CVSS can help describe severity, but it is not a declaration that your device is vulnerable. For firmware integrity and recovery planning, NIST SP 800-193 discusses protecting platform firmware against unauthorized changes, detecting changes, and recovering rapidly and securely.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to label the strength of a finding
Keep the distinction between a lead and a product-specific conclusion visible in your notes or report. A practical evidence scale is:
| Evidence | What it supports | What it does not establish on its own |
|---|---|---|
| Version-like string or banner | A possible component or version to investigate. | That the component is present in the running firmware, that the version is exact, or that a CVE applies. |
| Extracted file or package metadata | Evidence that a named file or component clue exists in the inspected image. | That the vulnerable code is enabled, reachable, or applicable to the device’s configuration. |
| Vendor SBOM entry | The vendor’s stated component inventory and, where supplied, version or hash. | That every CVE associated with that component affects the product. |
| Vendor advisory or VEX for the exact product and release | A product-specific affected, fixed, or not-affected determination, within the scope the vendor states. | Applicability to other hardware revisions, regions, or firmware releases not covered by the statement. |
The Open Source Firmware Foundation’s Firmware Embedded SBOM Specification makes the limit of outside inspection explicit: “Only the entity with the source code tree and the config files used to build it (usually the IBV or ODM) has all the information required to know whether a given EFI binary is affected by a specific vulnerability.” The point is not that binary inspection is useless; it is that some build and configuration facts may be available only to the supplier.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat to do when you cannot confirm a match
Ask the vendor a question it can answer
Provide the exact model, hardware revision, region, firmware version, firmware image hash, candidate CVE, and the evidence that led you to the match. Ask whether that product configuration is affected, whether a fixed version is available, and whether the vendor can provide an SBOM or VEX status. A precise request is more actionable than reporting only that a scanner found a version string.
Keep the assessment reproducible
Retain the firmware image or its source and hash, tool output, component evidence, links to CVE and vendor records, and the date of each check. Firmware releases and vulnerability records evolve, so a dated finding describes what was known about a particular file and product configuration at that time—not every later release.
Do not generalize study results into a scanner accuracy claim
A 2022 research preprint reported that its method filtered 68% of naïve Linux kernel version-to-CVE matches as false positives in a case study of 127 router firmware images. That figure describes the authors’ method and sample, not a universal false-positive rate for firmware scanning or a prediction for an individual device. See the paper for its scope.
What changed in the public guidance
CISA announced updated joint SBOM minimum elements on July 29, 2026, including refined fields for component hash, license, tool name, and generation context, alongside an emphasis on machine-processable formats. The announcement is available at CISA’s update notice. When relying on an SBOM, advisory, or NVD record, consult the current document and preserve the version or date you used.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
