Wemo Smart Plugs Remain Vulnerable to Cyberattacks Due to Unpatched Bug

The Wemo Mini Smart Plug V2, one of the most popular IoT devices for remotely controlling electronics, has been found to have a security vulnerability that allows for cyberattacks and potentially moving deeper into an internal network. Researchers at Sternum discovered that a buffer-overflow vulnerability, which affects model F7C063 of the device, allows remote command injection. The flaw that is identified with a CVE-2023-27217 can enable an attacker to turn electronics on and off remotely along with the potential for gaining access to other devices. The vulnerability, discovered to exist in the device’s firmware for its naming feature, can affect both businesses and consumers, posing considerable security harm.

The device, which has integrated support for voice assistants such as Alexa and Google Assistant, is used by businesses and consumers globally. Although the researchers recommend that individuals using this version of the Wemo Plugin inside their network be stopped or at the very least, make sure that the UPNP ports are not exposed to remote access. Reports from analysis indicate total sales on Amazon alone in the hundreds of thousands, making it a widespread issue that needs to be addressed soon.

Experts say that this vulnerability is a clear sign that vendors are still struggling with security by design, and organizations should take this into account when installing any smart device. “If you only rely on responsive security patching as most device manufacturers do today, two things are certain. One, you will always be one step behind the attacker; and two, one day those patches will stop coming. IoT devices should be equipped with “the same level of endpoint security that we expect other assets to have, our desktops, laptops, servers, etc.,” says Igal Zeifman, Sternum’s vice president of marketing.

Users of the device are encouraged to avoid exposing the Wemo Smart Plug V2’s UPNP ports to the Internet, either directly or via port forwarding. If you are using the Smart Plug V2 in a sensitive network, you should ensure that it is correctly segmented to make sure the device cannot communicate with other sensitive devices on the same subnet. Such precautionary measures will help reduce the impact of the unpatched bug until a firmware update is developed to fix the vulnerability.