The OWASP IoT Top 10 explained with fixes
In short: The OWASP IoT Top 10 lists the ten most common ways connected devices are made insecure, from guessable passwords to missing physical protection. It is a checklist for designers, testers and buyers, and each item has a clear fix.
What the list is
OWASP (the Open Worldwide Application Security Project) is a non-profit community best known for its web application Top 10. Its IoT project published an IoT Top 10, with the current edition dating from 2018. The list is short on purpose: it names the problems that appear again and again in real devices so that teams fix the basics before worrying about rarer attacks. The items are numbered I1 to I10, roughly from most to least common.
The ten risks and their fixes
| Risk | What it looks like | Fix |
|---|---|---|
| I1 Weak, guessable or hardcoded passwords | admin/admin logins, one password across every unit, a hidden support account baked into firmware | Unique per-device credentials or forced change at setup; no hidden accounts; rate-limit logins |
| I2 Insecure network services | Telnet, debug or UPnP services listening on the network | Turn off everything not needed; authenticate and encrypt what remains |
| I3 Insecure ecosystem interfaces | Cloud API or mobile app that lacks authorisation checks, so users can see other users' devices | Strong authentication, object-level access checks, API testing |
| I4 Lack of secure update mechanism | No updates at all, updates over plain HTTP, unsigned images, no rollback protection | Signed firmware, encrypted delivery, anti-rollback, user notification |
| I5 Use of insecure or outdated components | Old Linux kernel, outdated OpenSSL or BusyBox inside the firmware | Keep an SBOM (software bill of materials), track CVEs, rebuild with patched libraries |
| I6 Insufficient privacy protection | Collecting more personal data than needed, sharing it without consent | Data minimisation, clear consent, deletion on request |
| I7 Insecure data transfer and storage | Plain-text MQTT, Wi-Fi passwords stored unencrypted in flash | TLS for all traffic, encrypted storage, keys in secure hardware |
| I8 Lack of device management | No inventory, no way to see versions, revoke a device or push a fix to the fleet | Device management platform with inventory, monitoring and remote update |
| I9 Insecure default settings | Open setup mode, remote access on by default, weak cipher suites | Secure by default; users opt in to riskier features |
| I10 Lack of physical hardening | Open UART or JTAG headers giving a root shell, removable storage with secrets | Disable debug ports in production, lock bootloader, enclosure tamper protection |
Common mistakes when applying it
- Testing only the device. I3, I6 and I8 are about the cloud, app and management side. Many serious IoT breaches happened in the back end.
- Treating "has updates" as enough. An update channel without signing (I4) is a gift to attackers, because it lets them install their own firmware.
- Forgetting the supply chain. A product can be built with care and still ship an outdated library from a chip vendor's software kit (I5).
- Leaving factory test features in. Debug shells and test accounts that helped manufacturing often survive into production (I2, I10).
Using the Top 10 at work and in exams
If you buy devices for an organisation, turn the list into procurement questions: does each unit have a unique password, how long will updates be provided, is firmware signed, can we disable cloud features we do not need? If you build devices, map each item to a design requirement and a test case. In a penetration test of your own or an authorised product, the list gives a structure for the report.
The OWASP list lines up well with formal baselines such as ETSI EN 303 645 and NIST IR 8259A, so learning it gives you a head start on those too.
Tip: in exam answers, pair each risk with a concrete example and a specific control. "I4: unsigned updates could let an attacker load malicious firmware; fix with code signing verified by secure boot" scores far better than naming the item alone.
Practice
A smart plug ships with Telnet open and a root password shared by all units. Which items does this break?
Why does a software bill of materials help with I5?
Give a fix for I10 on a production circuit board.
Key takeaways
- The OWASP IoT Top 10 names the ten most common IoT security failures.
- Credentials, exposed services and missing secure updates top the list.
- Several items concern the cloud, app and fleet management, not just the device.
- Every item has a practical fix that can become a design requirement or test.
- The list maps closely to ETSI EN 303 645 and NIST IR 8259A.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.