A factory reset _is not_ enough. A factory reset will just clear a part of the NVRAM that holds configuration - any firmware implant will still be on the device

A factory reset _is not_ enough. A factory reset will just clear a part of the NVRAM that holds configuration - any firmware implant will still be on the device. There were no vulnerabilities included in the cherryblossom leak. The firmware implant deployment instructions included in the leak don't mention using any vulnerabilities either. Almost all of the devices listed in the cherryblossom leak are not being sold anymore.