Short answer: Yes. Hardware firewalls are vulnerable to infection in similar ways as computers because they are simply just another computer.
There is no such thing as a "hardware firewall". These are simply dedicated computers with dedicated operating systems and dedicated software etc. It is still a computer which runs software which therefore could be infected should someone discover a vulnerability.
The pro's of a "hardware" firewall is there is theoretically less software running and less access/connectivity points which needs testing for vulnerabilities, therefore these devices could be less likely of being infected. However it is not impossible.
The con's of a "hardware" firewall is it is less likely to receive software updates (otherwise known as firmware updates) over its lifetime. This means if a vulnerability is discovered with the device it may take a long time for a patch to be created fixing this (if a patch is created at all).
One exception to this patching rule could be Cisco and other dedicated networking security organisations who make it their job to "stay ahead of the curve". These people may release patches faster. However to receive this service you would be spending a lot more than a home-market firewalling solution will cost you.
Note: If you do not keep your network infrastructure patched and up to date you will be liable to all known vulnerabilities for your device and the version of software running upon it. The same is true of software firewalls and the operating systems on your own computer.
Case in point: Internet Census 2012
"Abstract: While playing around with the Nmap Scripting Engine (NSE) we discovered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or default credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most common ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage. All data gathered during our research is released into the public domain for further study. "
This person (or group) had used default usernames and passwords and vulnerabilities of "embedded devices" (which could include routers, phones, firewalls, printers, many "internet connected" devices) to gain access to the device and run code which helped them to discover more devices.
"Additionally, with one hundred thousand devices scanning at ten probes per second we would have a distributed port scanner to port scan the entire IPv4 Internet within one hour."