Embedded devices play a crucial role in our daily life. Code components within an embedded device transmit user input through various data sharing channels that are customized by the manufacturers. However, these channels introduce an attack surface to the device’s firmware - malicious user inputs can lead to vulnerabilities such as memory corruption and command injection. The considerable disparity in data sharing interfaces and protocols hinders existing methods, complicating the identification of data flow amongst code components and consequently obstructing effective vulnerability detection. In this paper, we propose a static analysis tool named Dbridger to discover vulnerable data sharing paths, which contain key API calls of data sharing. Our primary insight lies in the fact that the data sharing procedure can be modeled as the store/load operations upon a data sharing station, no matter how the interfaces and protocols are implemented by the manufacturers. By identifying the data sharing station, Dbridger can expose the implicit data sharing and discover the vulnerable ones in the firmware. Our evaluation shows that Dbridger can identify 1304 data sharing station APIs, which epitomize the feature implementations underlying data sharing operations, 124,543 data sharing paths that signify the modeled data sharing procedures from 10 firmware images, exposing a large number of data sharing operations within the firmware. Further analysis shows that 25,486 bridging paths are suspicious. 22 vulnerabilities are discovered in these suspicious paths and 21 of them cannot be discovered by existing work.