{"id":"https://openalex.org/W7164826209","doi":"https://doi.org/10.1109/jiot.2026.3703749","title":"A Comprehensive Empirical Study of Security Vulnerabilities in IoT Gateway Software","display_name":"A Comprehensive Empirical Study of Security Vulnerabilities in IoT Gateway Software","publication_year":2026,"publication_date":"2026-06-15","ids":{"openalex":"https://openalex.org/W7164826209","doi":"https://doi.org/10.1109/jiot.2026.3703749"},"language":null,"primary_location":{"id":"doi:10.1109/jiot.2026.3703749","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3703749","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063431969","display_name":"Diego R. Gomes","orcid":"https://orcid.org/0000-0002-3944-0068"},"institutions":[{"id":"https://openalex.org/I76903346","display_name":"University of Coimbra","ror":"https://ror.org/04z8k9a98","country_code":"PT","type":"education","lineage":["https://openalex.org/I76903346"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Diego R. Gomes","raw_affiliation_strings":["Department of Informatics Engineering, CISUC/LASI, University of Coimbra, Coimbra, Portugal"],"raw_orcid":"https://orcid.org/0000-0002-3944-0068","affiliations":[{"raw_affiliation_string":"Department of Informatics Engineering, CISUC/LASI, University of Coimbra, Coimbra, Portugal","institution_ids":["https://openalex.org/I76903346"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086908622","display_name":"Fernando Lins","orcid":"https://orcid.org/0000-0002-4007-3891"},"institutions":[{"id":"https://openalex.org/I62921916","display_name":"Universidade Federal Rural de Pernambuco","ror":"https://ror.org/02ksmb993","country_code":"BR","type":"education","lineage":["https://openalex.org/I62921916"]}],"countries":["BR"],"is_corresponding":false,"raw_author_name":"Fernando A. Aires Lins","raw_affiliation_strings":["Department of Applied Computing, Federal Rural University of Pernambuco, Recife, Brazil"],"raw_orcid":"https://orcid.org/0000-0002-4007-3891","affiliations":[{"raw_affiliation_string":"Department of Applied Computing, Federal Rural University of Pernambuco, Recife, Brazil","institution_ids":["https://openalex.org/I62921916"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016622594","display_name":"Marco Vieira","orcid":"https://orcid.org/0000-0001-5103-8541"},"institutions":[{"id":"https://openalex.org/I102149020","display_name":"University of North Carolina at Charlotte","ror":"https://ror.org/04dawnj30","country_code":"US","type":"education","lineage":["https://openalex.org/I102149020"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Marco Vieira","raw_affiliation_strings":["Department of Computer Science, University of North Carolina at Charlotte, Charlotte, NC, USA"],"raw_orcid":"https://orcid.org/0000-0001-5103-8541","affiliations":[{"raw_affiliation_string":"Department of Computer Science, University of North Carolina at Charlotte, Charlotte, NC, USA","institution_ids":["https://openalex.org/I102149020"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.76525948,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":"14","first_page":"30303","last_page":"30324"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.18359999358654022,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.18359999358654022,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.09149999916553497,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.0843999981880188,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.6428999900817871},{"id":"https://openalex.org/keywords/gateway","display_name":"Gateway (web page)","score":0.5598000288009644},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5242999792098999},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4796999990940094},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.3312999904155731},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.27959999442100525}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8029000163078308},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.6428999900817871},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5684000253677368},{"id":"https://openalex.org/C2777710495","wikidata":"https://www.wikidata.org/wiki/Q5527195","display_name":"Gateway (web page)","level":2,"score":0.5598000288009644},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5242999792098999},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4796999990940094},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.44369998574256897},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3312999904155731},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.27959999442100525},{"id":"https://openalex.org/C187713609","wikidata":"https://www.wikidata.org/wiki/Q2465461","display_name":"Default gateway","level":2,"score":0.2793000042438507},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2775999903678894},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.2615000009536743},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.25920000672340393},{"id":"https://openalex.org/C144543869","wikidata":"https://www.wikidata.org/wiki/Q2738570","display_name":"Mobile computing","level":2,"score":0.2538999915122986}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2026.3703749","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3703749","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.40573325753211975,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Internet":[0],"of":[1,50,62,138,166,188,213,239],"Things":[2],"(IoT)":[3],"gateways":[4],"play":[5],"a":[6,58,71,116,145],"critical":[7,205],"role":[8],"in":[9,52,65,222],"interconnecting":[10],"heterogeneous":[11],"devices,":[12],"local":[13],"networks,":[14],"and":[15,44,77,96,107,115,155,172,201,226,236],"cloud":[16],"infrastructures.":[17],"Vulnerabilities":[18,95],"affecting":[19,152],"these":[20,189],"devices":[21],"pose":[22],"significant":[23],"security":[24,63],"risks.":[25],"Despite":[26],"this":[27],"relevance,":[28],"existing":[29],"studies":[30],"primarily":[31],"focus":[32],"on":[33,88],"generic":[34],"IoT":[35,53,66,89,183,240],"assets,":[36],"leading":[37],"to":[38,124,231],"high":[39],"false-positive":[40],"rates,":[41],"incomplete":[42],"coverage,":[43],"limited":[45],"insight":[46],"into":[47],"root":[48,180],"causes":[49,181],"vulnerabilities":[51,64],"gateways.":[54,184],"This":[55,79],"paper":[56],"presents":[57],"comprehensive":[59],"empirical":[60,142],"study":[61],"gateway":[67,223,241],"software,":[68],"supported":[69,110],"by":[70,111],"systematic":[72],"methodology":[73],"for":[74,136,204,210],"asset":[75],"identification":[76],"validation.":[78],"work":[80],"offers":[81],"the":[82,125,139,178,211,233],"first":[83],"curated":[84],"dataset":[85,121],"focused":[86],"exclusively":[87],"gateways,":[90],"comprising":[91],"483":[92],"validated":[93],"Common":[94,126],"Exposures":[97],"(CVEs)":[98],"obtained":[99],"through":[100],"iterative":[101],"glossary":[102],"refinement,":[103],"automated":[104],"vulnerability":[105,147],"collection,":[106],"expert":[108],"adjudication":[109],"explicit":[112],"scope":[113],"criteria":[114],"full-consensus":[117],"acceptance":[118],"protocol.":[119],"The":[120,141,161],"is":[122],"mapped":[123],"Weakness":[127],"Enumeration":[128],"(CWE)-1000":[129],"Research":[130],"View,":[131],"enabling":[132],"hierarchical":[133],"root-cause":[134],"traversal":[135],"80.3%":[137],"vulnerabilities.":[140],"analysis":[143],"reveals":[144,192],"high-risk":[146],"profile,":[148],"with":[149],"most":[150],"issues":[151],"operating-system-level":[153],"components":[154],"scoring":[156],"High":[157],"or":[158],"Critical":[159],"severity.":[160],"results":[162],"identify":[163],"Improper":[164,169,173],"Control":[165,175],"Resources":[167],"(CWE-664),":[168],"Neutralization":[170],"(CWE-707),":[171],"Access":[174],"(CWE-284)":[176],"as":[177],"dominant":[179],"across":[182],"A":[185],"qualitative":[186],"decomposition":[187],"three":[190],"pillars":[191],"recurring":[193],"concrete":[194],"weaknesses":[195,221],"(buffer":[196],"overflows,":[197],"OS":[198],"command":[199],"injection,":[200],"missing":[202],"authentication":[203],"functions)":[206],"that":[207],"individually":[208],"account":[209],"majority":[212],"high-severity":[214],"exploitation":[215],"outcomes.":[216],"These":[217],"findings":[218],"reveal":[219],"systemic":[220],"software":[224],"stacks":[225],"development":[227],"practices,":[228],"offering":[229],"insights":[230],"improve":[232],"architectural":[234],"resilience":[235],"secure":[237],"design":[238],"platforms.":[242]},"counts_by_year":[],"updated_date":"2026-07-09T05:49:46.723101","created_date":"2026-06-16T00:00:00"}