Many early IoT devices exposed an embedded web server for configuration. These interfaces often shipped with default admin passwords and little input validation, so a single exposed device could be compromised from the network or the internet.
Force a change of default credentials on first use, enforce account lockout, test web interfaces for injection, XSS, and CSRF, and serve them only over HTTPS.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#01iot01 Weak Authentication and Access Control
No change since 20182018
#01iot01 Weak, Guessable, or Hardcoded Passwords
No change since 20142014
#01iot01-2014 Insecure Web Interface
