If a computer is directly connected to the internet, it is vulnerable to attacks.
So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our hardware firewall become the one vulnerable to attacks?
If that's the case, wouldn't the hardware firewall itself be infected?
Aren't we just substituting a lamb with a new one?
The main reason for getting hardware firewall is also not because the computer is directly vulnerable to attacks, it's because you need a fast performing device, which is manageable and has the ability to do complex filtering. Getting a hardware firewall for just one computer is a bit silly.
The amount of possible attack vectors is reduced as less various attack surface is present. A firewall has a lot less applications running than a computer in the first place. Also a firewall which is correctly placed in a network does not have its administrative interfaces (which manage the firewall) facing the internet. These are managed from a seperate, restricted network.
This means that you would need to be able to have some kind of buffer overflow when it checks the incoming connections. This would be possible theoretically but the likelihood is quite low. I'm not saying impossible, but lower.
Short answer: Yes. Hardware firewalls are vulnerable to infection in similar ways as computers because they are simply just another computer.
There is no such thing as a "hardware firewall". These are simply dedicated computers with dedicated operating systems and dedicated software etc. It is still a computer which runs software which therefore could be infected should someone discover a vulnerability.
The pro's of a "hardware" firewall is there is theoretically less software running and less access/connectivity points which needs testing for vulnerabilities, therefore these devices could be less likely of being infected. However it is not impossible.
The con's of a "hardware" firewall is it is less likely to receive software updates (otherwise known as firmware updates) over its lifetime. This means if a vulnerability is discovered with the device it may take a long time for a patch to be created fixing this (if a patch is created at all).
One exception to this patching rule could be Cisco and other dedicated networking security organisations who make it their job to "stay ahead of the curve". These people may release patches faster. However to receive this service you would be spending a lot more than a home-market firewalling solution will cost you.
Note: If you do not keep your network infrastructure patched and up to date you will be liable to all known vulnerabilities for your device and the version of software running upon it. The same is true of software firewalls and the operating systems on your own computer.
Case in point: Internet Census 2012
http://internetcensus2012.bitbucket.org/paper.html
"Abstract: While playing around with the Nmap Scripting Engine (NSE) we discovered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or default credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most common ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage. All data gathered during our research is released into the public domain for further study. "
This person (or group) had used default usernames and passwords and vulnerabilities of "embedded devices" (which could include routers, phones, firewalls, printers, many "internet connected" devices) to gain access to the device and run code which helped them to discover more devices.
"Additionally, with one hundred thousand devices scanning at ten probes per second we would have a distributed port scanner to port scan the entire IPv4 Internet within one hour."
The probability of infection/compromise is related to the generality of function. Hardware firewalls provide a very limited set of features/functions, and have a correspondingly limited probability of compromise. I believe it was Gene Spafford who first observed that the probability of compromise is directly related to the number of lines of code. (I suspect it is closer to an exponential relationship).
Anything that accepts and interprets external inputs has the potential to be compromised.
Installing a hardware firewall between your workstation and the internet isn't going to make you secure because nothing is going to make you 100% secure. What you want to aim for is risk reduction. You can reduce risk by minimizing attack surface and running well-maintained versions and a good network firewall can help you do that.
If you install a hardware firewall with lots of "advanced" features like deep packet inspection and intrusion detection and never patch it, you've got a big surface area and vulnerable interfaces.
There are probably more attack vectors for a workstation than a firewall, you're hopefully not reading email and opening pdfs on your firewall. That said, a network firewall isn't going to mitigate many of those attack vectors (phishing, malware-infected files, XSS) so you need to secure the firewall and the workstation. A well designed firewall with a good configuration is going to reduce the risk of network based scans and attacks.
A network firewall will also help you after your workstation is compromised. If you rely on a host-based firewall and your host is compromised, the attacker will just disable the firewall and exfiltrate data. If there's a network firewall in the middle and it's blocking non-approved outbound connections, it makes exfiltration a little more difficult.
One almost example where a firewall can be accessed / exploited (and then things can be changed):
