Unencrypted traffic lets anyone on the same network, or along the path to the cloud, capture credentials, personal data, and control commands, and replay or alter them.
Encrypt all traffic with TLS, validate certificates, and use encrypted protocols for local network communication as well as internet traffic.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#04iot04 Insecure Data Handling and Privacy
No change since 20182018
#04iot04 Lack of Secure Update Mechanism
No change since 20142014
#04iot04-2014 Lack of Transport Encryption
