Report ID CES-2026-001 · 10 Nov 2026
| Client | Example Devices GmbH (fictional) |
|---|---|
| Product | GW-200 IoT Gateway, hardware rev C |
| Firmware reviewed | v2.4.1, ELF + linker map + full source |
| Platform | STM32F429 · FreeRTOS · lwIP · Mbed TLS · Ethernet + MQTT/TLS |
A point-in-time engineering review of the material listed above. It is not exhaustive: the absence of a finding does not mean the absence of a vulnerability. It describes gaps against Annex I of Regulation (EU) 2024/2847 and is not legal advice, a certification, or a determination of conformity.
The GW-200 has a good base but four gaps that would block CRA conformity, and one issue that matters today under the reporting obligation in force since 11 Sep 2026:
| Area | Status |
|---|---|
| Known vulnerabilities / SBOM | Gap |
| Secure boot and update integrity | Gap |
| Access control and debug | Gap |
| Confidentiality / crypto | Partial |
| Exploitation mitigation | Partial |
| Vulnerability handling process | Gap |
| Data minimisation / deletion | Adequate |
| Reporting readiness (Art. 14) | Gap |
| ID | Finding | Severity | Effort |
|---|---|---|---|
| F-01 | End-of-life Mbed TLS 2.16.0 with 38 known CVEs, linked and reachable | Critical | 1–2 wk |
| F-02 | OTA images accepted with only a CRC32 check, no signature | High | 3–5 wk |
| F-03 | SWD debug port open on production unit | High | 2–3 days |
| F-04 | Shared default web-UI password on all units | High | 1–2 wk |
| F-05 | FreeRTOS 10.0.1 with 6 known CVEs | Medium | 3–5 days |
| F-06 | No MPU configuration; no stack protector | Medium | 1–2 wk |
| F-07 | TLS server certificate verification optional | Medium | 1 day |
| F-08 | No CVD policy, security contact or reporting owner | Medium | 2–3 days |
| F-09 | Debug shell compiled into release build | Low | 1 day |
Generated from the shipped image with fwsbom using the linker map, so only components with code in the final image are listed.
| Component | Version | Linked | Known vulns | Supported line |
|---|---|---|---|---|
| Mbed TLS | 2.16.0 | yes | 38 | 3.6.x LTS |
| FreeRTOS-Kernel | 10.0.1 | yes | 6 | 11.1 LTS |
| lwIP | 2.1.2 | yes | 2 | 2.2.x |
| STM32F4xx HAL | 1.7.8 | yes | 0 | 1.8.x |
CRA: Annex I Part I (2)(a), no known exploitable vulnerabilities; Part II (1)
Evidence: mbedtls/version.h → 2.16.0; ssl_tls.o, x509_crt.o,
bignum.o present in the linker map. The 2.16 branch has been end of life since 2021. 38 matches, including
CVE-2021-44732 (Critical; fixed in 2.16.12 / 2.28.0). The TLS client handles every cloud connection, so it is reachable from the network.
Recommendation: Upgrade to Mbed TLS 3.6 LTS. The 2.x to 3.x API changes are concentrated in the TLS client configuration (about 300 lines). Regenerate the SBOM and rescan.
8 more detailed findings with evidence and fixes, a prioritised roadmap to 11 Dec 2027, the attached CycloneDX SBOM, and the method appendix.
Join the assessment waitlist