IoT ecosystems span the device, its cloud service, and companion apps. Weak authentication on any of them, or authorization checks that do not separate users and roles, lets attackers control devices that belong to other users.
Require strong passwords, offer multi-factor authentication for cloud and mobile accounts, enforce role-based access, and protect credentials in storage and transit.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2014Latest
#02iot02-2014 Insufficient Authentication/Authorization
