I-O DATA DEVICE, INC. — Vulnerabilities & Security Advisories 33

I-O DATA DEVICE, INC. specializes in network infrastructure hardware, including routers, switches, and storage devices, primarily serving enterprise and industrial environments. Security audits reveal a concerning pattern of vulnerabilities, with 33 CVEs currently documented. These flaws predominantly involve remote code execution (RCE) and cross-site scripting (XSS), often stemming from inadequate input validation in embedded web interfaces. Several incidents highlight critical privilege escalation risks, allowing unauthenticated attackers to gain administrative control over network devices. The company’s historical approach to security updates has been inconsistent, leaving many deployed units exposed to known exploits for extended periods. While not a primary target for large-scale nation-state attacks, the sheer volume of accessible vulnerabilities makes these devices attractive for botnet recruitment. Recent patches have addressed some critical RCE vectors, yet the legacy of poor secure development practices remains evident in the persistent nature of these security gaps across their product line.