Devices frequently shipped with Telnet, FTP, or vendor debug services enabled. These services were rarely hardened and became the main entry point for botnets that scan the internet for exposed devices.
Expose only the ports that are needed, remove debug and legacy services, disable UPnP exposure to the internet, and fuzz network services for buffer overflows and DoS conditions.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#03iot03 Insecure Update and Patch Management
No change since 20182018
#03iot03 Insecure Ecosystem Interfaces
No change since 20142014
#03iot03-2014 Insecure Network Services
