via Sean: The following link is quite relevant to us: http://www.s3.eurecom.fr/docs/usenixsec14_costin.pdf It's about automated scans of embedded firmware images and is quite recent.
http://www.eurecom.fr/en/publication/4323/detail/a-large-scale-analysis-of-the-security-of-embedded-firmwares

a large catalog of interesting publications: http://www.s3.eurecom.fr/publications.html

Une backdoor dans un routeur Netis/Netcore
http://www.nearsecurity.net/love-china-netisbackdoor-exploitation/