The cloud service is the control plane for every device a vendor sells. A weakness there scales: one vulnerable API can expose every customer's devices and data.
Secure cloud interfaces with strong authentication, account lockout, TLS, and regular security testing, and avoid revealing whether accounts exist.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#06iot06 Vulnerable Third-Party Components
No change since 20182018
#06iot06 Insufficient Privacy Protection
No change since 20142014
#06iot06-2014 Insecure Cloud Interface
