  Currently, the development of IoT firmware heavily depends on third-party
components (TPCs) to improve development efficiency. Nevertheless, TPCs are not
secure, and the vulnerabilities in TPCs will influence the security of IoT
firmware. Existing works pay less attention to the vulnerabilities caused by
TPCs, and we still lack a comprehensive understanding of the security impact of
TPC vulnerability against firmware. To fill in the knowledge gap, we design and
implement FirmSec, which leverages syntactical features and control-flow graph
features to detect the TPCs in firmware, and then recognizes the corresponding
vulnerabilities. Based on FirmSec, we present the first large-scale analysis of
the security risks raised by TPCs on $34,136$ firmware images. We successfully
detect 584 TPCs and identify 128,757 vulnerabilities caused by 429 CVEs. Our
in-depth analysis reveals the diversity of security risks in firmware and
discovers some well-known vulnerabilities are still rooted in firmware.
Besides, we explore the geographical distribution of vulnerable devices and
confirm that the security situation of devices in different regions varies. Our
analysis also indicates that vulnerabilities caused by TPCs in firmware keep
growing with the boom of the IoT ecosystem. Further analysis shows 2,478
commercial firmware images have potentially violated GPL/AGPL licensing terms.
