Nordic Semiconductor supports connected device manufacturers' security responses by adding firmware security vulnerability management capabilities to its cloud platform. In particular, the focus has been on strengthening features to comply with the European Union (EU) Cyber Resilience Regulation (CRA).


Nordic Semiconductor announced on the 7th that it is adding a 'Firmware Vulnerability Scanning' feature to nRF Cloud. This will enable device manufacturers to more efficiently identify and manage software vulnerabilities in their operating products.

The new feature operates based on the Software Component List (SBOM). When a developer uploads an SBOM, the system automatically detects Common Vulnerabilities and Exposures (CVE) information.

In addition, you can check the number of devices exposed to the vulnerability among the actual operating devices connected to the nRF cloud. It is designed to determine the priority of security measures and track the status of patch application.

Nordic explained that this feature supports meeting the vulnerability monitoring requirements of the EU Cyber Resilience Law without the need to establish a separate vulnerability management system.

The new vulnerability scanning feature integrates with nRF Cloud's Firmware Over-the-Air (FOTA) service. This allows for the management of security patch distribution and application status on a single platform.

Device manufacturers can perform the entire process, from vulnerability detection to patch distribution and verification of resolution, within a single system, and an audit trail feature is also provided.

Nordic stated that it is possible to continuously monitor vulnerability exposure status in actual deployment environments and check the progress of security updates.

The firmware vulnerability scanning feature is scheduled to be available within the next few weeks. Developers can utilize this feature through the nRF cloud platform, and existing services, including FOTA, are currently available.