  Fuzzing is utilized for testing software and systems for cybersecurity risk
via the automated adaptation of inputs. It facilitates the identification of
software bugs and misconfigurations that may create vulnerabilities, cause
abnormal operations or result in systems' failure. While many fuzzers have been
purpose-developed for testing specific systems, this paper proposes a
generalized fuzzer that provides a specific capability for testing software and
cyber-physical systems which utilize configuration files. While this fuzzer
facilitates the detection of system and software defects and vulnerabilities,
it also facilitates the determination of the impact of settings on device
operations. This later capability facilitates the modeling of the devices in a
cybersecurity risk assessment and analysis system. This paper describes and
assesses the performance of the proposed fuzzer technology. It also details how
the fuzzer operates as part of the broader cybersecurity risk assessment and
analysis system.
