Known security vulnerabilities in connected devices, particularly those for which manufacturers have already released patches, remain the biggest cybersecurity threat to the Internet of Things (IoT). This is according to a new report by Bitdefender and Netgear, which examines exposed IoT devices, their security weaknesses and the cyberattacks targeting them.
The report highlights smart TVs as the most vulnerable category of connected devices, accounting for approximately 23% of all vulnerabilities identified by researchers during public internet scans. Smart plugs and network-attached storage (NAS) devices followed, each representing around 22% of the identified vulnerabilities. IP cameras ranked fourth, accounting for approximately 7%.
According to the report, devices designed to make everyday activities more convenient, such as smart plugs, can become easy entry points for cybercriminals. Meanwhile, NAS devices, which often store large volumes of sensitive information, are particularly attractive targets because of the valuable data they contain.
Smart TVs Present Growing Security Concerns
Smart TVs are emerging as a significant cybersecurity concern, especially when they are connected to networks without proper security management. The report points out that this risk extends beyond residential environments to businesses that install televisions in conference rooms and offices but often fail to include them in regular security monitoring.
Because modern televisions are connected to the internet and equipped with various smart features, they can expose organisations to multiple forms of cyber threats.
Hackers who compromise these devices may exploit their built-in microphones to monitor conversations, use them as stepping stones to access other devices on the same network, or turn them into residential proxies. In the latter case, compromised televisions can be used to route malicious internet traffic through legitimate residential connections, making suspicious activities harder to identify.
This means that a device originally installed for presentations, entertainment or communication could potentially become an entry point into an organisation’s wider IT infrastructure.
Unpatched Vulnerabilities Remain the Biggest Threat
One of the report’s most important findings is that almost all the IoT security exposures identified by Bitdefender and Netgear were linked to publicly known vulnerabilities for which patches were already available.
This suggests that many security incidents could be prevented if device owners and organisations regularly updated their equipment and applied available firmware security fixes.
The report also found that attacks exploiting weak passwords or unencrypted authentication accounted for only a small proportion of the observed threats. This challenges the assumption that poor password practices are the primary security problem affecting connected devices.
Instead, outdated firmware and unpatched software flaws appear to present a much greater risk.
Linux Firmware Vulnerabilities Feature Prominently
The research identified three high-severity Linux vulnerabilities among the leading firmware Common Vulnerabilities and Exposures (CVEs) affecting IoT devices.
An examination of the broader collection of relevant CVEs revealed that nearly half had a severity rating of 7.8, while only a relatively small number received higher scores.
The report also examined the types of technical weaknesses affecting connected devices. Slightly more than half involved buffer overflow vulnerabilities, which occur when a device attempts to handle more data than its allocated memory can accommodate.
Such weaknesses can potentially allow attackers to disrupt normal operations or execute malicious code, depending on the vulnerability.
Denial-of-service vulnerabilities and memory corruption flaws each accounted for approximately one-fifth of the weaknesses observed.
These findings demonstrate how weaknesses in device firmware and underlying software components can expose connected equipment to serious security threats.
What Businesses Should Expect and Do Next
As organisations continue to adopt smart devices, IoT security must become an important part of their wider cybersecurity strategies.
The Bitdefender and Netgear report offers several predictions that could influence how businesses approach connected-device security. One notable expectation is an increase in vulnerability disclosures affecting products from multiple manufacturers.
This could happen because different manufacturers sometimes rely on the same firmware components, connectivity libraries and underlying hardware platforms. Consequently, a security flaw in one shared component could expose devices from several vendors simultaneously.
For businesses, this makes maintaining an accurate inventory of connected devices increasingly important. Organisations need to know what equipment is connected to their networks, which firmware versions those devices are running and whether security updates are available.
Continuous monitoring is equally important because compromised IoT devices may provide attackers with opportunities to move between network systems, collect information or redirect malicious traffic without immediately attracting attention.
The growing number of connected devices means that businesses can no longer afford to overlook equipment such as smart TVs, cameras, smart plugs and network storage systems.
Ultimately, securing an organisation’s network requires looking beyond computers and smartphones. Every internet-connected device can potentially become a security weakness if it is not properly maintained, updated and monitored.
Source: cybersecuritydive Edited by Bernie
