IoT Reality: Smart Devices, Dumb Defaults
Summary: Cisco researchers in April 2014 alerted HVAC vendor Trane to three critical vulnerabilities in its Internet-connected ComfortLink II thermostats, which shipped with hardcoded passwords that let attackers log in remotely over SSH and use the devices as a foothold into the home network. Trane patched the hardcoded credentials on January 26, 2016, and had fixed the other two bugs in a May 2015 standard update without telling customers the update was critical to their protection.
What you should know: Cisco's Craig Williams noted that compromised IoT devices typically stay compromised until replaced, and that the roughly 10-year lifetime of these devices far exceeds the 2-year software lifetime vendors plan for - so the hardcoded password sitting on a thermostat today may outlast every other control on your network.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026