Study: Serious Web Security Flaws Rampant on Embedded Devices

A large-scale academic study emulating 246 embedded-device firmware images found that 185 (75%) contained high-impact web-interface vulnerabilities — totaling 9,271 issues — including command injection, XSS, CSRF, and credential/configuration exposures. The report highlights systemic problems (few firmwares enabling HTTPS, insecure default services like Telnet/FTP/RTSP, leftover manufacturing/testing modules) and vendor-specific examples (Netgear devices exposing configuration and credentials), stressing a broad attack surface across routers, CCTV and other IoT devices though it does not document confirmed active exploitation campaigns.