Router Penetration Testing Based on CEM Vulnerability Assessment Criteria

As a crucial component of modern network infrastructure, routers' performance can be severely impacted if they fall victim to hacker attacks, affecting all network devices connected to them. Router manufacturers should ensure sufficient cybersecurity measures for their products, such as undergoing information security certification, to prevent customers from encountering unforeseen vulnerabilities when using their routers. In reality, most routers on the market have not been certified for information security, primarily because the certification process is time-consuming and costly. One of the main reasons for this is that security testing during the certification process requires different security validation methods based on the product's functionalities. This study adheres to the Common Methodology for Information Technology Security Evaluation (CEM) testing methodology under the international information security certification standard “Common Criteria.” It conducts penetration testing on common router functionalities. It integrates the necessary testing tools, processes, and results to provide a reference for future researchers, reducing testing complexity and enhancing product security assurance.