Nordic Adds Firmware Vulnerability Scanning to nRF Cloud

Nordic Semiconductor, a global leader in low-power wireless connectivity solutions, has announced the addition of a new Firmware Vulnerability Scanning feature to its nRF Cloud platform. This enhancement further strengthens nRF Cloud's capabilities in supporting compliance with the EU Cyber Resilience Act (CRA).

With nRF Cloud's Firmware Vulnerability Scanning, developers can simply upload a Software Bill of Materials (SBOM) to nRF Cloud, which will then automatically detect Common Vulnerabilities and Exposures (CVEs) contained within the SBOM. Furthermore, it can analyze the extent to which these vulnerabilities affect the entire fleet of production devices connected to nRF Cloud.

This new feature is designed to help device manufacturers meet the vulnerability monitoring requirements mandated by the CRA, reducing the burden of building and maintaining their own CVE detection systems. The feature also works in conjunction with the Firmware Over-the-Air (FOTA) service, which enables the large-scale distribution of software updates to devices deployed in the market.

Reducing the Burden of CRA Compliance

The CRA mandates that the security of connected equipment must be maintained throughout the entire product lifecycle. As some products are expected to operate for extended periods, from several years to over a decade, compliance efforts must continue even after product shipment.

By providing vulnerability detection and FOTA capabilities, nRF Cloud offers an environment where developers can efficiently manage compliance while focusing on the product development that truly matters. This results in a shorter time-to-market and enables continuous regulatory compliance with limited resources even after product shipment.

Continuous Vulnerability Detection and Visualization of Actual Impact

With the new Firmware Vulnerability Scanning, nRF Cloud continuously and automatically scans SBOMs uploaded by developers for each software version.

Additionally, it visualizes how many deployed devices are actually affected by each detected vulnerability. This information makes it easier to prioritize which vulnerabilities to address. It also allows for real-time monitoring of security patch deployment status and continuous tracking of vulnerability remediation progress.

Achieving Detection to Remediation within a Single System

By combining this with nRF Cloud's existing FOTA functionality, device manufacturers can centrally manage everything from vulnerability detection to patch distribution and confirmation of fix completion within a single system. Furthermore, all work history is recorded as an Audit Trail.

The ability to monitor the status of security patch distribution in real-time also makes it easy to grasp the progress of remediation efforts across the entire device fleet. Leveraging nRF Cloud allows developers to streamline compliance with crucial CRA requirements such as continuous vulnerability monitoring and the provision of security updates.

Availability

The Firmware Vulnerability Scanning feature is scheduled to be available within the next few weeks. By registering for a webinar showcasing the actual operation, you can get an early look at the feature's details and receive the latest information upon its official release.

Various nRF Cloud features, including FOTA, are available now. Developers can create a free developer account and start using the platform at any time.

For those who wish to learn more about the CRA requirements, please refer to the guide provided by Nordic.

###

About Nordic Semiconductor

Nordic Semiconductor is a global leader in low-power wireless connectivity solutions, offering a comprehensive platform that includes hardware, software, development tools, and cloud-based lifecycle services. This simplifies and accelerates the development of connected products while ensuring reliable performance throughout their lifecycle. Founded in 1983 and headquartered in Norway, Nordic employs approximately 1,450 people worldwide. As a pioneer and industry leader in Bluetooth® Low Energy (Bluetooth LE), the company has expanded its wireless solutions to include cellular IoT, Wi-Fi, Matter, Thread, Zigbee, DECT NR+, and NTN/satellite communications. In 2025, Nordic will enhance its chip-to-cloud offering by acquiring Memfault, adding advanced device monitoring and cloud-based observability capabilities to its comprehensive wireless product portfolio. Nordic's technologies and solutions enable the creation of secure, scalable, and energy-efficient connected products in the consumer, healthcare, and industrial sectors, supporting the development of a smarter, more connected world. For more information, please visit https://www.nordicsemi.com.