![](bg3.png)
The distinction between frontend and backend al-
lows differentiating the vulnerabilities exposed over
the Internet and the ones exploitable internally. IoT
devices typically connect to frontend by a web Appli-
cation Programming Interface (API) over HyperText
Transfer Protocol (HTTP). As the frontend is open to
the Internet, it is experiencing constant scanning and
intrusion attempts. To be categorized to the frontend,
a component must be intended to be Internet-facing,
otherwise it is backend. In practice, the division is
hard to make and the differences between the two sub-
system results are indicative rather than conclusive.
Many CVEs are for the major operating systems:
Android, iOS, MacOS, Windows, and Linux variants.
Android is well-known as a mobile phone OS, but it
is also used in IoT. Linux is used everywhere, in de-
vices, desktops, and servers. Windows is used in the
desktop, servers, but also in IoT devices. Apple’s iOS
is used in mobile phones, pads, and other personal de-
vices. MacOS is to the best of our knowledge not used
outside desktops. Apple has also tvOS.
When a vulnerability is reported in the interaction
between a frontend and a device or mobile applica-
tion, it is categorized as the CVE describes the situa-
tion. A CVE for a software component is categorized
by the primary function of the component with the ex-
plicit software component category as a fallback. For
example, a web API component goes to the frontend
and a mobile application framework goes to the mo-
bile. An image rendering component would be cat-
egorized as a component. Many vulnerabilities in a
subsystem are actually in software components.
2.2 Inferring Attack Vectors
For our study, we identify the attack vector(s) which
enable the exploitation of a vulnerability. CVSS al-
ready contain an Attack Vector metric, but it does not
give details like the network protocol (FIRST, 2022).
We infer a more detailed attack vector.
Browsing the CVE data quickly reveals that the
most common attack vector is Hypertext Transfer
Protocol (HTTP). HTTP is so prevalent that it is often
not explicitly mentioned, but it must be deduced from
the description. Vulnerabilities are also reported on
Domain Name System (DNS), Server Message Block
(SMB), Transport Layer Security (TLS), X.509 cer-
tificate handling, Internet Protocol (IP), Wireless Lo-
cal Area Network (WLAN), Bluetooth, etc.
Some vulnerabilities are in the parsing of differ-
ent file formats, with the vector of delivering the file
into the system often unknown. This includes failing
to properly sanitate stored files. Many vulnerabilities
are local, they cannot be exploited unless the attacker
Table 2: CVSS version 3 metrics and values, with an aster-
isk marking the worst value for the defender.
Metric Values
AV Attack Vector Physical, Local, Adjacent, Network*
AC Attack Complexity Low*, High
PR Privileges Required None*, Low, High
UI User Interaction None*, Required
S Scope Unchanged, Changed*
C,
I, A
Confidentiality, In-
tegrity, Availability
High*, Low, None
has access to the system, e.g. as a regular user. Vul-
nerabilities requiring physical access to the vulnera-
ble systems are included to the local attack vector. For
some CVEs, it is not possible to infer the attack vector
from the available information.
2.3 CVSS Metrics
CVSS is used to estimate the technical severity of
vulnerabilities (FIRST, 2022). The CVSS version
3 Base metric group contains the context and time-
independent information, see Table 2.
The metric Attack Vector defines the context
where exploitation is possible. (As said, we infer a
more detailed attack vector for analyzed CVEs.) At-
tack Complexity is high if exploitation requires con-
ditions beyond attacker control and low if it does not.
Privileges Required describes the level of privileges
the attack requires. A vulnerability may require User
Interaction to succeed. Scope indicates if the security
impact crosses security domains. Finally, the impact
metrics Confidentiality, Integrity, and Availability es-
timate the effect of successful exploitation on the sys-
tem security goals. The value we consider the worst
value from the defender’s point of view is marked by
an asterisk in Table 2.
In the results, we highlight how the CVSS met-
rics vary between different CVE data sets and sub-
systems. To avoid the problem of converting CVSS
metrics into numeric values, we use the proportion of
the worst value. In NVD data the worst value is the
most common value for all but the Scope metric, as
the value Unchanged is more common than Changed.
The proportions are compared to the averages from
CVEs in 2020 and 2021.
2.4 Margin of Error
We calculate the margin of error (MOE) for some
resulting proportions M
e
= z
p
p(1 − p)/n, where p
is the proportion, n is the number of samples, and
z = 2.57 for 99% confidence level or z = 1.96 for 95%
confidence (Sheldon M., 2004, p. 260-262).
Vulnerabilities in IoT Devices, Backends, Applications, and Components
661