Vulnerability Research

Root Cause and Patch Analysis

We identify the actual source of a vulnerability in the code. We check whether the published patch addresses this source and whether the same bug can be triggered in other ways.

Schedule a Meeting All services in this area

What it is

Vulnerability advisories usually describe only the symptom, not the cause. Root cause analysis pinpoints where in the code the missing check or faulty assumption is. Patch analysis compares the patched and unpatched versions to show what the patch changed. This reveals incomplete patches and variants of the same bug.

Scope

Root cause analysis of a vulnerability reported or identified in your product
Comparison of a security patch for a product you use with the previous version
Searching other parts of the product for the same code pattern (variant analysis)
Checking whether the fix has reached all supported versions
Interim mitigation and detection advice when the patch cannot be applied immediately

The need

When organizations need it

When a critical vulnerability is announced in an internet-facing VPN or firewall appliance you use and you are unsure if the patch is sufficient.
When a vulnerability previously fixed in your product reappears with a different input.
When you cannot apply the patch immediately and need to understand the actual remaining risk.

Method

How we work

Comparison

We compare the patched and unpatched versions and identify the changed code sections.
Root cause

We determine which assumption caused the bug and under what conditions it is triggered.
Variant search

We search for the same pattern in other parts of the code and in different versions.
Assessment

We share whether the patch is sufficient, what risk remains, and which interim measures apply.

Outcome

What you have at the end

You know whether the patch fully addresses the vulnerability. You have a prioritized list of remaining variants and measures to take until patching.

Frequently asked questions

Can this be done without source code?

Yes. The analysis can be done by comparing compiled versions. With source code, it proceeds faster.

What happens if the patch is found to be incomplete?

The finding is reported to the vendor through coordinated vulnerability disclosure. Until a fix is published, details are shared only with you and the vendor.

Does analyzing another vendor's patch pose licensing issues?

Some license agreements may restrict reverse engineering. Before starting, we review the scope with you according to the license terms.

Vulnerability Research