IoT ecosystems span the device, its cloud service, and companion apps. Weak authentication on any of them, or authorization checks that do not separate users and roles, lets attackers control devices that belong to other users.
Require strong passwords, offer multi-factor authentication for cloud and mobile accounts, enforce role-based access, and protect credentials in storage and transit.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#02iot02 Insecure Network Services and Protocols
No change since 20182018
#02iot02 Insecure Network Services
No change since 20142014
#02iot02-2014 Insufficient Authentication/Authorization
