Issue Details
Insecure Default Settings
iot09 • Rank #9 in OWASP 2023
Explanation
IoT devices often prioritize ease of use over security in default configurations. Insecure defaults include open network services, disabled security features, permissive access controls, and verbose error messages. Most users never change default settings, leaving devices exposed to automated scanning and exploitation.
Remedy
Ship devices with secure default configurations. Disable unnecessary services and features by default. Require security configuration during initial setup. Implement secure-by-default principles for all settings. Provide clear guidance for security configuration.
| Year | Rank | Category |
|---|---|---|
| 2018 | #9 | iot09 - Insecure Default Settings |
| 2022 | #9 | iot09 - Insecure Default Configuration |