Zero-day vulnerability

A zero-day vulnerability is a security flaw in software, firmware or hardware that attackers know about before the maker has fixed it, often before the maker even knows it exists. The name counts the days the maker has had to respond: zero. The U.S. National Institute of Standards and Technology (NIST) defines a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. Once a fix is published the flaw is no longer a zero-day, but every device that has not installed the fix stays exposed, and for connected devices that gap can last for years.

What is the difference between a zero-day vulnerability, exploit and attack?

They are three steps of the same problem. The vulnerability is the weakness itself, for example a bug in how a camera’s firmware reads a network message. The exploit is the code or technique that takes advantage of the weakness, such as a specially crafted message that lets an outsider run commands on the camera. The attack is the use of the exploit against real victims.

A vulnerability can sit unnoticed for years; it becomes urgent when someone starts using it. The EU Cyber Resilience Act draws the same line in its definitions: a vulnerability is a weakness that can be exploited by a cyber threat, and an “actively exploited vulnerability” is one for which there is reliable evidence that a malicious actor has used it on a system without the owner’s permission (Article 3, points 40 and 42). Once a flaw is public it usually receives a CVE identifier, a reference number that lets everyone talk about the same bug.

Why do IoT devices stay exposed for longer?

Because the fix reaches them late, or never. A phone or a laptop often installs a fix automatically within days; many connected devices work differently:

• Firmware is updated rarely. The firmware, the software built into the device, may be updated only a few times in the product’s life.
• No automatic updates. Without a working over-the-air (OTA) update system, the owner has to install the fix by hand, which many never do.
• Long supply chains. A flaw in a chip maker’s software or an open-source library must be fixed by that supplier first, then by every brand that uses it.
• Products out of support. When a maker stops supporting a product, newly found flaws are no longer fixed. Such flaws are sometimes nicknamed “forever-days”, because the weakness is public but for that device a patch will never come. The security support period tells you when that point arrives.

Industrial equipment has the same problem in a stronger form: NIST notes that updates to operational technology cannot always be installed promptly, because they must be tested first and outages planned in advance (SP 800-82 Rev. 3, Section 2.4). Unpatched devices reachable from the internet are also easy recruits for botnets.

What is the CISA Known Exploited Vulnerabilities catalog?

It is a public list of vulnerabilities that have been used in real attacks, kept by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). A flaw enters the Known Exploited Vulnerabilities (KEV) catalog only when it meets three criteria: it has a CVE identifier, there is reliable evidence that it has been actively exploited, and there is a clear way to fix it, such as an update from the vendor. U.S. federal civilian agencies must fix listed flaws within set deadlines, which since 10 June 2026 come from Binding Operational Directive 26-04, and must remove affected products that are end-of-life or cannot be updated. CISA strongly recommends that every organization monitor the catalog and use it to decide which updates to install first.

The catalog lists routers, IP cameras, network storage drives and industrial controllers alongside office software. Because inclusion requires a clear fix, a zero-day usually appears there after the maker has responded.

What does the Cyber Resilience Act require when a flaw is being exploited?

Since 11 September 2026, manufacturers of connected products sold in the EU must report actively exploited vulnerabilities in their products. Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, sets three deadlines; the first two are counted from the moment the manufacturer becomes aware of the exploitation:

• an early warning within 24 hours;
• a vulnerability notification within 72 hours, with general information about the product, the exploit and the corrective measures taken or available to users;
• a final report no later than 14 days after a fix or other corrective measure is available.

The reports go at the same time to the national computer security incident response team (CSIRT) designated as coordinator and to ENISA, the EU cybersecurity agency, through a single reporting platform (Article 14(1)). The manufacturer must also inform affected users and tell them how to limit the damage (Article 14(8)). Most of the regulation applies from 11 December 2027, but Article 14 has applied since 11 September 2026 (Article 71(2)), and it also covers products placed on the market before December 2027 (Article 69(3)). The Cyber Resilience Act entry summarizes the rest of the law.

What can you do if you own a connected device?

You cannot prevent a zero-day, but you can shorten the time your devices stay exposed once a fix exists:

• Turn on automatic updates where the device or its app offers them, and check by hand for firmware updates on devices that do not update themselves.
• Before buying, look for the date when security support ends. Under the Cyber Resilience Act, makers will have to state at least the month and year at the time of purchase (Article 13(19)) for products placed on the market from 11 December 2027.
• Replace devices that no longer receive updates, starting with routers, cameras and others reachable from the internet.
• Turn off remote access features you do not use, and put smart devices on a separate guest network if your router offers one.
• Change default passwords, which limits the damage from many other flaws as well.

In a company, keep a list of devices and their firmware versions, compare it with new KEV entries, and isolate equipment that cannot be patched. IoT security fundamentals explains the wider set of defenses.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.