NetRise Discovers That More Than 80% of Devices Remain Exposed to Pixie Dust a Decade After Disclosure

AUSTIN, Texas, Sept. 17, 2025 ~ NetRise, a company specializing in identifying software and firmware supply chain risks, has recently published a new research report titled "Legacy Vulnerabilities in Wireless Firmware: The Lingering Threat of the Pixie Dust Exploit." The report sheds light on the persistent vulnerabilities in consumer and SMB networking equipment, despite being first disclosed in 2014.

The research conducted by NetRise analyzed firmware from 24 devices across six vendors, including routers, access points, and range extenders. These devices had firmware releases spanning from 2017 to 2025. Shockingly, the findings revealed that only four of these devices were ever patched for the Pixie Dust exploit, on average, almost a decade after its disclosure.

According to Thomas Pace, co-founder and CEO of NetRise, Pixie Dust is not just a vulnerability but also a case study on how insecure defaults and weak patching processes continue to persist in firmware. He further stated that consumers expect their newly purchased products to be secure but this research proves otherwise. Pace emphasized the need for enterprises to go beyond vendor self-attestation and instead analyze the compiled code on the device to create a comprehensive and accurate Software Bill of Materials (SBOM) to manage risk effectively.

More on EntSun News

• Agemin Unveils Breakthrough AI Model for Biometric Age Estimation, Setting New Standards in Online Child Safety
• Strategic Partnerships with Defiant Space Corp and Emtel Energy USA Powerfully Enhance Solar Tech Leader with NASA Agreements: Ascent Solar $ASTI
• 120% Revenue Surge with Four Straight Profitable Quarters Signal a Breakout in the Multi-Billion Dollar Homebuilding Market: Innovative Designs $IVDN
• Leading Venture Capital Firms Recognize Wzzph Exchange's Technical Architecture and Security Framework as Industry Benchmark
• Studio Dia'ani Launches AI-Powered Creative Platform for Content Creators and Entrepreneurs

The key findings of the research are alarming. Only 17% of the known vulnerable devices received patches for Pixie Dust. On average, it took 9.6 years for the earliest patch to be delivered after the vulnerability was discovered. Even more concerning is that 13 actively supported devices remain unpatched and seven reached end-of-life without any fixes.

The rapid exploitability of Pixie Dust is another cause for concern as attackers can recover WPS PINs within seconds, bypassing password complexity. This highlights chronic issues in firmware supply chains and raises questions about vendor transparency when it comes to security vulnerabilities.

NetRise's research also echoes recent warnings from CISA about two actively exploited TP-Link router vulnerabilities. While these are unrelated to Pixie Dust, the overlap is significant as almost half of the devices in the research sample were TP-Link products. This further emphasizes the central role of this vendor in the broader supply chain risk landscape.

More on EntSun News

• DivX Unveils Major DivX Software Update: Seamless Video Sharing and Customizable Playback Now Available
• Nespolo Mechanical Helps New Mexico Families Save Thousands on Heating Costs This Fall
• Leading Digital Finance Platform YNQTL Launches Revolutionary Web3 Digital Asset Trading Platform
• IDCXS Addresses Crypto Trading Pain Points with 2 Million TPS Processing and Multi-Layer Security Architecture
• Bridging Traditional Finance and Web3 Innovation: BLFCW Announces Strategic Vision for Regulated Web3 Economy

In light of these findings, NetRise has provided recommendations for organizations to mitigate the risks posed by legacy firmware. These include disabling WPS unless necessary, generating SBOMs through binary analysis, and auditing default configurations. The report also calls on vendors to adopt transparent advisories and implement secure-by-default practices to prevent long-tail exposures like Pixie Dust from persisting.

The research by NetRise serves as a wake-up call for both consumers and vendors to take firmware security seriously. With the increasing reliance on connected devices, it is crucial for organizations to prioritize security in their supply chain processes and for vendors to be transparent about vulnerabilities in their products. Failure to do so could leave networks vulnerable to exploitation and compromise sensitive information.

---

Show All News | Report Violation