Many early IoT devices exposed an embedded web server for configuration. These interfaces often shipped with default admin passwords and little input validation, so a single exposed device could be compromised from the network or the internet.
Force a change of default credentials on first use, enforce account lockout, test web interfaces for injection, XSS, and CSRF, and serve them only over HTTPS.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2014Latest
#01iot01-2014 Insecure Web Interface
