Top 7 IoT vulnerabilities
Industrial IoT has conquered factories, warehouses and consumer products. Connected supply chains at Schneider Electric, smart bikes at Decathlon, predictive maintenance solutions at Bosch… The Internet of Things has become a pillar of digital transformation.
But it still has an Achilles' heel: cybersecurity.
According to ENISA, more than 60% of IoT incidents recorded in Europe in 2024 still stem from known, unpatched vulnerabilities. At DVID, we see the same thing every day: in audits, trainings and field feedback, the same flaws come back again and again.
Here are the seven vulnerabilities we encounter most often — and why they are still around.
1. Hardcoded credentials and secret keys
An admin password built into the firmware. An API key copy-pasted from a vendor example. A private key stored in plain text in flash memory.
"It is rarely negligence, often just a leftover from prototyping." — Arnaud Courty, President of DVID
This kind of practice is still common, even in large groups. In 2023, a Palo Alto Networks study revealed that 52% of the firmware analyzed contained at least one hardcoded secret.
Once the firmware is extracted, the whole fleet is exposed.
At DVID, we turned it into a standard exercise: extract the key, understand the impact, then learn how to secure it. Because until you have seen it, you cannot grasp how dangerous it is.
2. Poorly protected OTA updates
A poorly secured Over-The-Air update is a wide-open front door.
And it is not just a startup problem: even Tesla and Withings have had to fix flaws in their OTA mechanisms.
The most common mistakes:
- downloads in clear text (HTTP instead of HTTPS),
- missing or poorly verified signatures,
- firmware that can be downgraded without version control.
"You cannot guarantee the security of a product if you do not control its update process." — CERT-ENISA, 2024 report on the IoT supply chain
A good practice is to sign firmware and verify its integrity locally. In a DVID training, the learner plays both roles: the attacker who injects a booby-trapped firmware, then the defender who sets up signing.
A full cycle that builds lasting reflexes.
3. Forgotten debug interfaces
UART, SWD and JTAG interfaces are the backstage of IoT.
They are used to develop, test and flash… but they should be disabled before production.
And yet they are still found active on devices sold by well-known brands.
"In 2022, 25% of IoT vulnerabilities reported to MITRE involved an unprotected debug interface." — MITRE CWE-1247 report
In the field, a single forgotten connector can provide full root access.
At DVID, this exercise is a must: identify the pins, connect, explore… then harden the device.
It is tangible, visual and unforgettable.
4. Overly chatty network services
A connected object talks a lot — sometimes too much.
We have seen industrial equipment exposing MQTT services on the Internet, and Bluetooth sensors broadcasting sensitive information without encryption.
The 2016 Mirai case, where connected cameras were enlisted into a global botnet, remains a lesson that has not been enough.
And yet in 2025 the same kind of mistake resurfaces, especially on Wi-Fi and BLE protocols.
"The more a system communicates, the more it must know what it says and who it says it to." — Dorian Peluso, DVID
The goal is not to shut everything down, but to understand everything. That is what we teach in our network trainings: trace, analyze, rationalize.
5. No usable traces (the IoT forensics nightmare)
When an incident occurs on an IoT product, it is often impossible to understand its cause.
No logs, no timestamps, no persistent records.
Microsoft recently noted that in 2024, 78% of IoT incidents had "no post-mortem data available".
Without visibility, improving security is impossible.
That is why embedded forensics is becoming a pillar of DVID trainings: learning to produce, collect and protect the artifacts needed to reconstruct an attack scenario.
A real cultural shift for the industry.
6. Supply chain dependency
Manufacturers buy, integrate and combine.
But when the security of a third-party module becomes your responsibility, the risk skyrockets.
The SolarWinds case showed that the supply chain is often the fastest route into a company's infrastructure. In IoT it is even more true: one compromised Bluetooth module, and an entire fleet of equipment becomes vulnerable.
"Connected objects are only as secure as their weakest supplier." — ENISA, "Threat Landscape 2024" report
At DVID, we often start from this observation: how do you test a product you did not design?
Our "white-label" trainings teach how to assess an external module, document its flaws and turn that feedback into a hardening plan.
7. Security documentation that does not keep up with the product
The product evolves, the documentation does not.
Firmware changes, cloud architectures move, but security test plans stay frozen.
It is a well-known problem among Industry 4.0 players, even in structured groups such as Siemens or Thales: development speed outpaces the ability to update documentation.
"Security is like quality: if you do not maintain it, it regresses." — Arnaud Courty, DVID
DVID's approach is to turn every vulnerability encountered into a replayable training: a living scenario that teams can experiment with, measure and review.
It is a way to keep security "up to date", at the same pace as the product.
These seven vulnerabilities are not new.
They persist because IoT security is still too often taught as theory, when it should be lived as a professional practice.
IoT is concrete: screws, ports, firmware, protocols.
And it is by handling them that you learn to secure them.
With DVID, "your teams no longer endure IoT security: they understand it, practice it and concretely improve it."
Learn more: https://dvid.eu
Contact us: https://dvid.eu/#contact
Follow our news: https://www.linkedin.com/company/dvid/