Eight certificates from eMudhra, a certificate authority trusted by major browsers, were found to have private keys that anyone could work out in seconds. Browsers were protected within hours, without users doing anything. Cameras, recorders, access control panels, and intercoms are different: many stay exposed until their manufacturer ships a firmware update and someone installs it on every affected device. In fleets of thousands of devices from dozens of manufacturers, that work is slow to do by hand, and every device it misses keeps trusting the compromised certificates.
In October, researchers found that eight intermediate certificates issued by eMudhra had been created with private keys that were trivially easy to guess (The Hacker News). With one of those keys, an attacker could create a valid-looking certificate for any website or service and use it to intercept traffic.
Google, Mozilla, Apple, and Microsoft blocked the certificates within days, and there is no confirmed malicious use so far. Software libraries and Linux distributions are shipping their own fixes, and Chrome will stop trusting the related eMudhra root certificate on October 27.
Browsers update their list of trusted certificates automatically. Most connected devices do not. Many IP cameras, NVRs, access control controllers, and intercoms carry a fixed list of trusted certificates inside their firmware, captured when that firmware was built. They keep trusting that list until the firmware changes.
Not every device is affected. Simpler devices that trust only one or two specific certificates likely are not. The ones to focus on carry a broad trusted list and connect to services outside your network, such as cloud platforms, integrations, or update servers. Finding them requires an inventory that shows the model and firmware version of every device, including the older ones.
On a laptop, this is fixed with a routine software update. On many devices, the only way to change the trusted list is to install new firmware from the manufacturer. That makes firmware management part of certificate trust, not only vulnerability patching. In practice:
Large fleets include thousands of devices across many manufacturers, models, and sites. Updating them by hand means checking each device, finding the right firmware, installing it, and confirming it worked. That takes months, and the oldest devices are the ones most often missed.
This will happen more often. Industry rules are shortening the maximum lifetime of publicly trusted certificates from 200 days today to 47 days by 2029. These rules don't apply to most device certificates, but the same expectations are likely to extend gradually to other connected endpoints. As that happens, certificate and firmware changes on devices will become more frequent. Automation lets device owners find affected devices, roll out updates in stages, confirm results, and keep a record, with IT and security supporting on network and policy needs.
Browsers were protected within hours because they control their own updates. Connected devices depend on firmware from many manufacturers and on someone applying it. Organizations that manage firmware and certificates together, with automation across the whole fleet, will close gaps like this one sooner the next time.
SecuriThings is the enterprise IoT orchestration platform that puts the teams responsible for physical security and IoT devices in command of every device in the fleet, across every manufacturer and site. SecuriThings brings the uptime, security, and remediation standards expected of enterprise IT to a long under-managed device category, automating remote device restart, password rotation, firmware upgrades, and certificate management across the fleet.
If you'd like to understand whether or not your fleet requires firmware updates to address this or other common vulnerability issues, SecuriThings offers a free no-obligation Platform Preview. With a simple CSV file of your fleet, we can assess the operational and cybersecurity posture of all of your devices, and provide recommended remediation steps.