CID4IoT: IoT-Oriented Command Injection Vulnerability Detection Based on Critical Code Extraction and LLM Analysis

The Internet of Things (IoT) devices have brought invaluable convenience to our daily lives. However, they also introduce significant security challenges. Common vulnerabilities in numerous IoT devices predominantly reside in their web services. Unfortunately, existing vulnerability detection methods either incur heavy execution overhead or produce excessive false positives/negatives. This significantly hinders the efficient analysis of vulnerabilities in web services. This paper proposes CID4IoT, a novel static automated vulnerability detection approach designed to effectively detect command injection vulnerabilities in web services provided by IoT devices. Inspired by the concept of taint analysis, CID4IoT first analyzes vulnerability reports to identify taint source functions and sink functions. Then, CID4IoT extracts pseudocode between taint source functions and sink functions to form critical code snippets. Subsequently, it utilizes LLM to analyze these critical code snippets for vulnerability detection.We implemented a prototype of CID4IoT and evaluated it on real firmware devices. CID4IoT discovered 54 previously unknown vulnerabilities, of which 39 are confirmed by CVE. Compared with state-of-the-art tools KARONTE and SaTC, it identified significantly more vulnerabilities in the test set while achieving notable improvements in analysis efficiency. The results demonstrate that CID4IoT is effective in detecting flaws in IoT devices