Consumer IoT security is the practice of building connected devices so they cannot be trivially hijacked—no shared default passwords, a working secure-update path, unique per-device credentials and a way to receive vulnerability reports. In 2025–2026 it stopped being optional: Europe's Radio Equipment Directive cybersecurity rules became mandatory on 1 August 2025, the Cyber Resilience Act adds reporting duties from September 2026 and full obligations from December 2027, and a string of real device failures shows exactly what non-compliance looks like. Security is now a condition of being allowed to sell.

What does 'consumer IoT security' actually mean?

It is a small set of basics that, done properly, block most attacks—and, done badly, cause the headlines. The baseline standard the industry has converged on, ETSI EN 303 645, leads with three provisions: no universal default passwords, a means to manage and act on vulnerability reports, and a mechanism to keep software updated through secure, authenticated updates. Around those sit unique per-device credentials, secure boot, encrypted communication, minimised attack surface and protection of personal data.

In plain terms: secure boot means the device checks a cryptographic signature at power-on so it only runs the manufacturer's genuine firmware, blocking tampered or backdoored images. A secure update mechanism means a signed, ideally automatic, over-the-air fix path—so when a flaw is found, it can actually be closed in the field. Unique per-device credentials mean every unit ships with its own secret instead of one shared key, which kills 'class-break' attacks where one cracked password opens every device on the market.

Why does consumer IoT security matter now?

Because the failures are current, concrete and expensive—and the same root causes keep repeating. In July 2026 researchers disclosed a hidden authentication backdoor across five Tenda router firmware versions (CVE-2026-11405): any username with a hardcoded password grants admin access. The devices shipped unpatched for weeks while the vendor initially ignored researchers; a fix arrived only after public pressure. TP-Link Kasa cameras were found leaking admin credentials and location data through a hardcoded cryptographic key. And a flaw in Shark robot vacuums—rooted in an overly permissive cloud policy where device certificates were not pinned to individual devices—let a certificate from one unit be accepted for commands to others; researchers observed over 1.5 million unique devices in a single cloud region, of which about 674,000 responded, exposing camera feeds, home maps and plaintext Wi-Fi passwords.

Zoom out and the pattern holds. There are now around 21 billion connected IoT devices globally, up 14% year on year. Three old botnet families—Mirai, Mozi and Gafgyt—still account for about 75% of malicious IoT payloads, and routers alone draw more than 75% of observed IoT attacks. The FBI's 2025 BADBOX 2.0 advisory described malware pre-loaded onto millions of cheap consumer devices before they were even sold. Hardcoded credentials, no secure-update path and weak defaults are behind almost all of it—the exact failures the new rules target.

The counter-example is the tell. In July 2026 Siemens launched a new Sinumerik One CNC generation and marketed the whole portfolio as 'CRA-ready'. When a major industrial vendor starts selling regulatory conformance as a product feature, compliance has crossed from differentiator to entry ticket.

What does it cost to ignore it?

Three ways, escalating. First, fines: under the Cyber Resilience Act, failing the essential cybersecurity requirements or core manufacturer obligations can cost up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher. Second—and usually worse—market access: without CE marking under the CRA (from December 2027) or RED cybersecurity conformity (already mandatory since August 2025), a connected product simply cannot be placed on the EU market. That is a binary go/no-go on an entire region, not a line-item penalty.

Third, the operational cost of shipping without a fix path. The Tenda and Shark cases show what happens next: public advisories, emergency firmware, brand damage, and—in Shark's case—a blast radius of hundreds of thousands of live-exposed homes traced to a single misconfigured certificate policy. A device you cannot securely update is a device you cannot rescue.

How do device makers get consumer IoT security right?

The good news is that the standard and the fix list are the same list. Practical steps:

• Kill shared secrets. Ship unique per-device credentials and remove every hardcoded password or key—this alone would have prevented the Tenda backdoor and the Shark shared-certificate flaw.

• Build a real update path. Signed, authenticated, ideally automatic OTA updates, plus a declared minimum support period (now required by the UK PSTI Act and expected under the CRA).

• Anchor trust in hardware. Secure boot and a hardware root of trust so the device only runs signed firmware; independent certification such as PSA Certified now goes to Level 4.

• Constrain the cloud side. Pin device certificates to individual devices and apply least privilege to IoT cloud policies—the Shark failure was a cloud-trust misconfiguration, not a chip flaw.

• Keep an SBOM and disclosure channel. Maintain a software bill of materials so you know instantly which products a new CVE touches, and publish a route for researchers to report flaws—an explicit EN 303 645 and CRA requirement.

• Test before you ship. Independent firmware analysis and lab testing against EN 18031 / EN 303 645 catch hardcoded keys, vulnerable components and missing secure boot before a product—and a headline—goes out.

This is the work SISA's hardware-security lab does for device makers—firmware analysis, secure-boot and credential review, and testing against the RED and CRA baselines—but the checklist above holds regardless of who runs it. With RED conformity already mandatory and CRA deadlines in 2026 and 2027, the manufacturers treating security as a shipping gate now are the ones who will still have an EU market in 2028.

Key takeaways

• Consumer IoT security is now a market-access gate in the EU, not a nice-to-have.

• The baseline (ETSI EN 303 645) is three things: no default passwords, a secure update path, and a vulnerability-report channel.

• 2026 device failures (Tenda backdoor, TP-Link Kasa, Shark vacuum) all trace to hardcoded secrets and weak cloud trust.

• Deadlines are live: RED cybersecurity rules mandatory since 1 Aug 2025; CRA reporting from 11 Sep 2026, full obligations 11 Dec 2027.

• Cost of ignoring: CRA fines up to €15M or 2.5% of turnover—and, worse, no CE mark means no EU sales at all.

Frequently asked questions

Is ETSI EN 303 645 mandatory?

The standard itself is voluntary, but conformity to it is how manufacturers demonstrate they meet the now-mandatory EU Radio Equipment Directive cybersecurity requirements (via the harmonised EN 18031 standards) and the upcoming Cyber Resilience Act. In effect, meeting EN 303 645 is the practical route to being allowed to sell connected consumer products in the EU.

What is the difference between the RED cybersecurity rules and the CRA?

The Radio Equipment Directive delegated act (mandatory from 1 August 2025) covers the cybersecurity of internet-connected radio equipment—network protection, privacy and fraud prevention. The Cyber Resilience Act is broader: it applies to almost all products with digital elements, mandates security-by-design, an SBOM, updates across a support period, and vulnerability/incident reporting (from September 2026), with full obligations from December 2027.

What are the most common consumer IoT security failures?

Hardcoded or shared default passwords and keys, no secure firmware-update mechanism, weak default configuration, unencrypted communication, and overly permissive cloud policies. The 2026 Tenda, TP-Link and Shark cases are textbook examples of the first and last of these.

How do we prove a device is secure?

Through independent testing and certification—firmware analysis to find hardcoded secrets and vulnerable components, secure-boot and credential review, and lab testing against EN 18031 / EN 303 645. Schemes such as PSA Certified (now up to Level 4) provide a recognised assurance level for the underlying silicon and secure boot.

Sources

• Tenda router backdoor CVE-2026-11405 (5 firmware versions) — CERT/CC VU#213560, Jul 2026; Tom's Hardware, Jul 2026

• TP-Link Kasa camera flaws (CVE-2026-9770 / -13230) — securityonline.info, Jul 2026; TP-Link advisory

• Shark vacuum cloud-trust flaw (~1.5M devices seen, ~674K responded) — The Hacker News / Malwarebytes, Jul 2026

• Siemens Sinumerik One 'CRA-ready' launch — Siemens press release / Industrial Cyber, Jul 2026

• 21.1B connected IoT devices (+14% YoY) — IoT Analytics, State of IoT 2025, Oct 2025

• Mirai/Mozi/Gafgyt = ~75% of IoT payloads; routers >75% of attacks — Zscaler ThreatLabz, Nov 2025

• BADBOX 2.0 (millions of devices) — FBI alert, Jun 2025

• ETSI EN 303 645 provisions — CCLab / Intertek breakdowns

• RED cybersecurity mandatory 1 Aug 2025 (EN 18031) — SGS, Jun 2025

• EU Cyber Resilience Act dates & penalties (Reg. 2024/2847, Art. 64) — European Commission; craact.eu

• UK PSTI Act (default-password ban) in force 29 Apr 2024 — The Hacker News, Apr 2024

‍