Cybersecurity researcher and embedded hardware specialist
Chris Watts
Chris Watts is an Australian cybersecurity researcher and embedded hardware security specialist. He is a Senior Cybersecurity Consultant at CyberCX, where he leads the embedded hardware testing capability, and he is the researcher credited by Cisco and NetComm for a series of vulnerability reports in cable modems, residential gateways, IP phones, carrier routers and industrial equipment published between 2014 and 2024.
He founded Tech Analysis, the Sydney consultancy under which his earlier research was published, co-founded the landing-page company PageLeap with Will Pemble, and created Wonderland History, a website documenting the Wonderland Sydney amusement park. His career spans more than three decades of programming, network and systems engineering, electronics and security work.
Chris joined CyberCX, an Australian cyber security company, in November 2020. He is a Senior Cybersecurity Consultant in its Security Testing and Assurance practice and the practice's Embedded Systems Service Lead and subject matter expert for embedded systems penetration testing. In that role he leads the embedded hardware testing capability: defining the methodology for hardware and firmware assessments, developing the tooling and frameworks the team uses, and driving new approaches to hardware-focused security testing. CyberCX research publications byline him as a Senior Security Consultant.
Across his career he has performed hundreds of penetration tests and technical security assessments for organisations in education, finance, banking, healthcare, utilities, telecommunications and government. The work includes hardware and firmware penetration testing and reviews, network segmentation testing, firewall assessments, vulnerability assessments, and web and web-service penetration testing, as well as in-depth reviews of PCI DSS environments, cloud platforms and enterprise infrastructure.
His research interests sit at the boundary of hardware and software: pulling apart embedded devices, analysing firmware, reverse engineering undocumented interfaces and developing proof-of-concept exploits so that vendors can fix the underlying flaws. The public record of that work is summarised below, with links to the original advisories.
Selected original research
These summaries follow the wording of the primary advisory in each case. Where an issue needs local or physical access rather than network access, that is stated, because secondary reporting has sometimes overstated it.
NetComm industrial router and VDSL modem remote code execution (2024)
In 2024 CyberCX published two pieces of research by Chris into NetComm devices sold into Australian industrial and consumer markets. The NetComm NTC-221 industrial IoT router contained an unauthenticated remote code execution flaw in its web interface that gave an adversary a root shell without credentials; NetComm released firmware 2.1.36.0 to address it. The NetComm NL1901ACV VDSL modem contained an input-sanitisation flaw that allowed authenticated remote code execution as root, fixed in firmware R6B033. Both posts document the discovery, the vendor coordination and the fix versions.
Cisco IOS XR bootloader information disclosure (2023)
Cisco advisory, credited to "Chris Watts of CyberCX". CVE-2023-20064.
Cisco's advisory describes a weakness in the GRUB bootloader of IOS XR Software, which runs on ASR 9000, NCS and related carrier routers. An attacker connected to the console port while the device is power-cycled could read sensitive files through the bootloader command line. This is a physical-access issue, not a remote exploit, and Cisco rated it medium severity.
Cisco cable modems and wireless residential gateways (2014 to 2016)
The most serious of these was a buffer overflow in the web server of nine Cisco DOCSIS 3.0 cable modem and gateway models (DPC and EPC 3010, 3212, 3825 and 3925, and the DPQ3925), allowing an unauthenticated remote attacker to execute arbitrary code. Cisco published it in July 2014 with its highest base score, and SecurityWeek and Threatpost reported it that week, naming Chris as the reporter. A similar unauthenticated remote code execution flaw in the DPC2203 and EPC2203 cable modems followed in March 2016. Three further findings in the DPQ3925 wireless residential gateway covered cross-site request forgery, information disclosure through the HTTP server, and a denial-of-service condition that restarts the device.
Chris reported six issues in the Cisco SPA300 and SPA500 series desk phones used by small businesses. The best known, published in March 2015, allowed an unauthenticated attacker with network access to send a crafted XML request to a phone in its default configuration and listen to its audio stream or place calls from it. Cisco credited "Chris Watts of Tech Analysis", and the finding was covered by iTnews, The Register, SecurityWeek, The Hacker News and Tripwire. The earlier July 2014 notices described a cross-site scripting flaw in the phone's web interface and an authentication weakness in the debug console that gives local shell access; Cisco's current notices for those two do not display a researcher credit, and the attribution rests on contemporary reporting by iTnews. Later advisories covered a firmware image upload weakness that requires local shell access, an HTTP denial of service, and a cross-site request forgery flaw. The original Tech Analysis announcements are preserved in the research archive.
Findings reported privately, 2016
Not every finding ends in a public advisory. In 2016 Chris reported the following to Netgear through private disclosure; no CVE or vendor advisory was published, so they are recorded here on his own account rather than in the public index below. The cable gateway findings came out of separate engagements for Telstra and for Optus.
Netgear cable gateways as supplied by Telstra BigPond and Optus, from the 2016 research. Photograph by Chris Watts.
Netgear remote unauthenticated CSRF DNS hijacking (July 2016). A cross-site request forgery flaw that let a remote, unauthenticated attacker change the DNS settings of the gateway. Devices: Netgear DEVG2020, Netgear VersaLink B90-755025-15 (Westell 7550), Netgear EVG2000, Netgear JWNR2000, Netgear VEVG2500, Netgear (Westell) ProLine modems.
Arbitrary code execution in Netgear cable home network gateways supplied by Australian ISPs (June 2016). Arbitrary code execution flaws in the Netgear CG814WG and CGD24N gateways supplied by Telstra BigPond and the Netgear CG814WGv3 supplied by Optus, found during separate engagements for Telstra and for Optus. Devices: Telstra BigPond Netgear CG814WG, Telstra BigPond Netgear CGD24N, Yes Optus Netgear CG814WGv3.
Netgear DEVG2020 CSRF remote arbitrary code execution (May 2016). A cross-site request forgery flaw leading to remote arbitrary code execution on the DEVG2020 xDSL premium business gateway. Devices: Netgear DEVG2020.
Cross-site scripting reported to website owners, 2017
During 2017 Chris found cross-site scripting flaws on a number of public websites, reported each to the site's owner, and saw them fixed. None was assigned a CVE; two organisations sent thanks in kind, a gift card from Jaycar and cinema tickets from Event Cinemas. May 2017: Jaycar, Coles online shop (shop.coles.com.au), Event Cinemas. July 2017: Parliament of Australia. October 2017: Crazy Domains, General Motors (gm.com), Australian Open Shop, Cancer Council Shop, Choice, Holden.
Public vulnerability research index
Every record below links to the primary advisory or publication. "Credit" quotes the attribution wording as currently published by the vendor or publisher; where the vendor page carries no name, the attribution source is given instead. Dates are the advisory's own first-published dates. Severity scores are omitted because vendor, NVD and CISA scores for several of these records differ in version and value; the linked advisories carry the vendor's scoring.
Vulnerability reports credited to Chris Watts, newest first
"Cisco would like to thank security researcher Chris Watts for discovering and reporting this vulnerability." (Cisco advisory, Source section (no organisation named))
Unauthenticated local attacker with access to the device shell. Not remote code execution.
"Cisco would like to thank security researcher Chris Watts for discovering and reporting this vulnerability." (Cisco advisory, Source section (no organisation named))
Unauthenticated remote attacker; a user must click a crafted URL.
The currently published Cisco notice displays no named credit. Attribution to Chris Watts of Tech Analysis is reported by iTnews (22 March 2015). Source.
Debug console authentication weakness, local code execution
Unauthenticated local attacker with local access to the device. Not remote.
The currently published Cisco notice displays no named credit. Attribution to Chris Watts of Tech Analysis is reported by iTnews (22 March 2015). Source.
This index lists public records with named attribution. It is not a count of all vulnerabilities Chris has reported; findings disclosed privately to vendors or clients are not included.
Independent coverage
Articles by journalists and industry writers that name Chris Watts in connection with the research above. Several articles report the same discovery, so they are grouped by the research they cover; the number of articles is not the number of discoveries.
July 2014: Cisco cable modem and gateway remote code execution (CVE-2014-3306)
Reports Cisco's advisory for the web-server buffer overflow in nine cable modem and gateway models and names Chris Watts of Tech Analysis as the reporter.
The original interview. Quotes Chris on the severity of the flaw and connects it with the two 2014 phone vulnerabilities; most of the following day's coverage cites this article.
Security vendor blog post that names Chris as the discoverer of the three phone vulnerabilities and links to the Tech Analysis research page preserved on this site. Byline not captured in the archived copy.
Attributes the DPQ3925 denial of service and the DPC2203/EPC2203 remote code execution to Chris; the same article covers a separate gateway flaw credited to Kyle Lovett, which is not Chris's.
Security news blog report of the March 2016 advisories, again distinguishing Chris's two findings from Kyle Lovett's.
Engineering and other projects
VCM1250 parcel measuring instrument
The VCM1250 non-contact dimensional measuring instrument. Photograph supplied by Chris Watts.
CubeLogic Systems came to Tech Analysis with a problem: they needed a non-contact machine that could measure postal parcels for trade. Chris designed and built the VCM1250 for them. A parcel placed on its platform is scanned by laser profile sensors, and the instrument reports length, width, height and volume in real time, on screen and over Ethernet and serial connections. He then took it through pattern approval under Australia's trade measurement framework: the National Measurement Institute issued certificate of approval NMI 13/1/28 for the CubeLogic Systems VCM1250 on 19 August 2015, covering objects from 10 to 59 centimetres on each side. The certificate is a record about the instrument, issued to the client company; it does not name individuals, and Chris's design and build role is his own account.
Village Roadshow Digital Copy rights management (2011)
The Digital Copy client application, here on the Hoodwinked Too! release. Screenshot by Chris Watts; film artwork belongs to its rights holders.
In 2011 Chris designed and wrote, through Tech Analysis, the client and server digital rights management software that Village Roadshow used for its Digital Copy programme, under which a DVD or Blu-ray buyer could transfer a protected digital version of the film using a code from the case. Sixty-two titles were released on the system, among them The Hunger Games, Sherlock Holmes, Magic Mike, The Artist, Red Dog, The Cabin in the Woods, Dark Shadows and Hoodwinked Too!, and, by his account, without a single technical support case. The titles and the support record are Chris's own statement; Village Roadshow has not published material about the system.
PageLeap
Chris co-founded PageLeap with his friend Will Pemble and served as its chief technology officer; the company's About page lists "Will Pemble, CEO and Co-Founder" and "Chris Watts, CTO and Co-Founder", describing him as a cyber security expert, embedded hardware specialist and full-stack developer. PageLeap built a platform for fast-loading landing pages. Its homepage now states that PageLeap has ended and that "the technology and patents were acquired in a private transaction"; the purchaser, price and date have not been published. Will Pemble discussed building PageLeap with his partner Chris in a 2024 interview on The CTO Show with Mehmet.
Chris founded Wonderland History, a website dedicated to the remembrance and history of Australia's Wonderland, also known as Wonderland Sydney, the amusement park at Eastern Creek in western Sydney that opened in December 1985 and closed in April 2004. The site describes itself as keeping the memory of the park alive since 2004, beginning as a record of the park's demolition, and has grown into a large archive of photographs, documents, maps and ride histories contributed by former staff and visitors; archived copies of the site go back to 2006. A 2012 press release on the site names Chris as its founder, Wikipedia's article on the park cites the site repeatedly, and a 2017 BuzzFeed photo feature on the abandoned park credits Chris Watts for its photographs and the online community he and friends built around it. Chris also set up and, with a small team of helpers, runs the public Facebook group Australia's Wonderland History, which has grown past 25,000 members.
A selected account. Roles overlapped at times; Tech Analysis ran alongside employed positions. Dates for the earlier roles are from Chris's own records.
November 2020 to present
CyberCX: Senior Cybersecurity Consultant; Embedded Systems Service Lead and Subject Matter Expert, Security Testing and Assurance
Hardware, firmware, network, cloud and application penetration testing across education, finance, banking, healthcare, utilities, telecommunications and government. Leads the embedded hardware testing capability: methodology, tooling frameworks and new assessment approaches. Credited reporter of CVE-2023-20064 (Cisco) and author of the 2024 NetComm research.
2018 to 2020
Servers Australia: Senior Systems Engineer
Virtualisation lead for private-cloud and VPS products, national infrastructure automation and auditing, network backup tooling, migrations and high-availability firewall systems.
May 2010 to January 2026
Tech Analysis: Founder and managing director
Australian-owned technology consultancy for clients from startups to listed companies: security testing and vulnerability research (including the zero-day findings reported to Cisco and the privately reported Netgear work), custom software and firmware in C, C++, assembly and other languages, Linux kernel modules and device drivers, high-availability infrastructure and virtualisation, network engineering, data recovery, migrations, ISP-grade hosting and web application development. Projects included the Village Roadshow Digital Copy rights management system (2011) and the VCM1250 measuring instrument for CubeLogic Systems. Source of the Cisco credits to "Chris Watts of Tech Analysis" between 2014 and 2017. Closed in January 2026.
2006 to 2010
Sony DADC: Network Systems Engineer
Network and server engineering for the disc manufacturer's Australian operations: internal and external security audits and penetration tests; more than 300 servers across AIX, Sun, Linux, Windows, macOS and VMware on IBM BladeCenter and HP blade hardware; Cisco, Nortel and Brocade switching and routing; the WAN links and rebuilt LANs for the Huntingwood, Erskine Park and Kingsgrove data centres and 75 km of dark fibre to St Leonards; a three-building VoIP rollout; isolated security and building-management networks; over 100 TB of EMC and IBM SAN storage; and the infrastructure behind the launch of Blu-ray disc manufacturing.
2000 to 2006
Web1: Co-owner
Co-founded and ran an ISP and IT consultancy: web, email and DNS hosting, software and web application development including chattoyourdoctor.com for a consortium of medical practitioners, and deployments of Medical Director practice software across general practices and specialist clinics, including migrations of practice data from legacy UNIX systems and staff training.
1996 to 1999
Self-employed: IT consultant
Hardware and software support for Apple Macintosh and PC systems, diagnostics, repairs and upgrades, and on-site technical solutions for small and mid-sized businesses across Sydney.
1995
Status Graph: Apple Service Engineer
Hardware diagnostics, repairs and component-level servicing across the 68k Macintosh range (Mac Plus to Quadra and LC) and the first Power Macintosh models, using Apple-certified repair procedures.
1992 to 1995
CGL Software: Programmer
Commercial desktop application development for the 68k Apple Macintosh in Think C and C++.
Technical background
Chris programs in C and C++, assembly across several instruction sets, PHP, JavaScript, shell and Python. He has written Linux kernel modules and device drivers, firmware and other embedded code, and has long experience with network design and administration (Cisco, Juniper, Brocade and others), virtualisation and cloud infrastructure, and Unix, Linux, Windows and Mac systems. On the hardware side he does electronics fault-finding, board-level repair and PCB design. That mix is what makes embedded device security a natural specialty: he can read the schematic, the firmware and the network traffic.
Professional enquiries about security testing should go to CyberCX.
About Tech Analysis. Tech Analysis is no longer trading. This website is maintained as the personal profile and research archive of its founder, Chris Watts, who now works at CyberCX. Earlier research remains attributed to Tech Analysis as originally published.
Chris Watts is a common name. This page concerns the Australian security researcher associated with Tech Analysis, CyberCX, PageLeap and Wonderland History, and is not connected with other people who share the name.
