JCC logo
OWASP Risks Atlasby Jer Catallo

Issue Details

Insecure Default Settings

iot09 • Rank #9 in OWASP 2023

Explanation

IoT devices often prioritize ease of use over security in default configurations. Insecure defaults include open network services, disabled security features, permissive access controls, and verbose error messages. Most users never change default settings, leaving devices exposed to automated scanning and exploitation.

Remedy

Ship devices with secure default configurations. Disable unnecessary services and features by default. Require security configuration during initial setup. Implement secure-by-default principles for all settings. Provide clear guidance for security configuration.

YearRankCategory
2018#9iot09 - Insecure Default Settings
2022#9iot09 - Insecure Default Configuration