Silent Entry: Firmware-Level Persistence in Enterprise Network Equipment
Detailed technical analysis of a firmware modification technique that survives factory resets and full OS reinstallation, identified across three major enterprise networking vendors during routine red team operations.
The Problem With ‘Clean’ Hardware
When an organization discovers a compromised router, the instinct is factory reset. It works. It wipes the configuration. It reinstalls the operating system. The device comes back online clean.
Except it doesn’t.
During a red team operation for an energy infrastructure client in late 2025, CIPHER researchers identified a persistence mechanism embedded at the firmware level — below the OS, outside the reach of any reset or reinstallation procedure the client’s security team could perform without vendor involvement.
Technical Analysis
The mechanism exploited a writable region in the device’s NVRAM that is initialized before the main OS load sequence. By writing a small staging payload to this region, an attacker could ensure code execution at boot, before any security software, before any network monitoring, before the OS itself was fully initialized.
The payload we recovered was minimal by design. Forty-eight bytes. It did one thing: establish an outbound connection to a hardcoded IP on a port that appeared to be legitimate management traffic.
Affected Vendors
We disclosed to three vendors under coordinated disclosure in November 2025. Two have issued firmware patches. One has acknowledged the report and has not yet published remediation.
We are not naming the third vendor in this publication. We are observing the standard ninety-day disclosure window. At ninety days plus one, we will publish the full technical details regardless of vendor status.
Detection Guidance
Organizations that cannot immediately verify firmware integrity should treat all suspect devices as compromised until proven otherwise. We have published a detection script that checks for the specific NVRAM region modification pattern — available to verified subscribers.