IoT devices are often deployed in places attackers can reach. Physical access can expose firmware, keys, and credentials that unlock the wider fleet.
Disable or protect debug interfaces such as JTAG and UART in production, encrypt data at rest, limit external ports, and make tampering detectable.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2022Latest
#10iot10 Lack of Security Lifecycle Support
No change since 20182018
#10iot10 Lack of Physical Hardening
No change since 20142014
#10iot10-2014 Poor Physical Security
