Lots of network devices don&#x27;t do any kind of real validation of the updates they get from a remote server, beyond using SSL which only checks that the origin is correct.<p>A while ago I accidentally stumbled upon the file servers that served updates for a major router manufacturer. The host vulnerability itself was reported and fixed, but I doubt they told their clients (the router company) anything.<p>In that case, anyone who found the vulnerability could have modified the binary blobs, I wonder if this is a similar case.