Abstract:Authentication is a key access control mechanism in Internet of Things (IoT) devices. However, improper design or configuration by developers may introduce authentication bypass vulnerabilities, significantly weakening system security. To determine whether IoT devices contain authentication-bypass vulnerabilities, existing studies mainly rely on manual reverse engineering of firmware to locate authentication logic, combined with symbolic execution techniques to identify input conditions that enable authentication-bypass, or they adopt heuristic rules for detection. However, manual reverse engineering incurs high costs, and heuristic rules have limited scalability, making it difficult to conduct authentication bypass vulnerability detection efficiently and at scale. To address these issues, this study proposes a novel automated authentication bypass vulnerability detection framework, FirmAuth, for IoT devices. The framework first automatically identifies authentication features of various services in firmware to locate authentication-related code. It then constructs a symbolic execution engine oriented to authentication logic to achieve efficient detection of authentication-bypass vulnerabilities. Experimental results show that, compared with existing methods, FirmAuth improves the detection rate of authentication-bypass vulnerabilities by approximately 11.6 times. So far, vulnerabilities discovered using this tool have been assigned four vulnerability identifiers.