Skip to content

Topic

IoT and Embedded Device Security

The practice of securing connected devices like cameras, routers, and sensors against firmware flaws, weak authentication, and network-based exploitation.

Current stories

securityConfirmed38 publishers

Coopérative U confirms a cyber-attack on refrigeration at several of its supermarkets

Coopérative U CEO Dominique Schelcher confirmed on October 12 that a cyber-attack hit refrigeration at several of its stores from October 11. The Danfoss link, the loss figures and the other chains named come from press reports, and Danfoss was asked for comment.

Perspective Coverage

53 publishers
Builder
Builder 32%
Operator
Operator 43%
Investor
Investor 25%

Reality

Evidence76
Adoption
Not scored
Hype gap+12
Incentives50
Confidence78
securityOne report1 publisher

Viidure dashcam platform exposes live footage and firmware through a publicly readable bucket

CISA says Viidure's dashcam platform keeps user records, live footage and firmware in a cloud bucket that anyone on the internet can read. Viidure did not answer CISA and plans no fix, so the advisory can only point users to the vendor's support page.

Publishers:cisa.gov

Reality

Evidence55
Adoption
Not scored
Hype gap0
Incentives
Not scored
Confidence58
securityOne report1 publisher

CVE-2026-22755 opens 37 VIVOTEK camera models to remote command execution

CISA lists 37 VIVOTEK camera models open to CVE-2026-22755, a command injection bug that can give attackers remote command execution, potentially as root. Exploit code was public before the advisory, so the first job for owners is finding out which of their cameras are on the list.

Publishers:cisa.gov

Reality

Evidence60
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence60
securityOne report1 publisher

Replaying camera traffic on the LAN gets admin on TP-Link's Tapo C200

An attacker already on the camera's network can replay traffic into an administrative session on an unpatched Tapo C200 and reach its live video. TP-Link's fix shipped in August.

Reality

Evidence58
Adoption22
Hype gap+25
Incentives60
Confidence52
productOne report1 publisher

DOJ names China's proxy quartermaster; the seizure took domains, not devices

Prosecutors say a Nanjing contractor rented IoT botnets and commercial proxies to the MSS and PLA from 2018. No individuals were charged, and the conscripted hardware stays conscripted.

Publishers:wired.com

Reality

Evidence58
Adoption47
Hype gap+24
Incentives62
Confidence61
securityOne report1 publisher

GivEnergy's administration leaves a backdoor with nobody left to patch it

Pen Test Partners says the battery maker declined to fix exposed older installs and did not act when the UK regulator asked. On 9 April 2026 it entered administration.

Reality

Evidence44
Adoption28
Hype gap+16
Incentives68
Confidence52
securityOne report1 publisher

Slovakia's speed cameras take orders by SMS: 279 devices, one procurement failure

The NBU says NERO R-ONE cameras bought under a 30-million-euro EU-funded project are rebadged Russian hardware carrying an SMS-triggered backdoor. The contract was the vulnerability.

Publishers:news.risky.biz

Reality

Evidence55
Adoption58
Hype gap+8
Incentives62
Confidence57