Unfixable Buffer Overflow Found in Belkin Wemo Smart Plug V2

In May 2023, researchers from IoT security company Sternum discovered a critical vulnerability in a Belkin Wemo Mini Smart Plug (F7C063), which they disclosed in February of the same year. The plug is a popular home automation device, allowing users to control electrical outlets remotely, which means that this vulnerability could lead to significant issues if exploited.

The security flaw was found to be a buffer overflow in the device software, specifically in the part that allows users to rename the device’s “FriendlyName”. The stack-based memory flaw allows attackers to remotely execute code, potentially compromising the entire device, and even the network it is connected to, depending on the device’s privilege level.

While this vulnerability is a serious issue for Wemo Mini Smart Plug owners, even more concerning is Belkin‘s lack of action. The company reportedly refused to patch the bug, citing the device’s “end of life” status, despite it still being available for purchase and in use in many households. This means that the flaw is unlikely to ever be fixed, leaving the devices indefinitely vulnerable.

This revelation serves as a reminder that the security of Internet of Things (IoT) devices can be a serious concern and that consumers must consider the long-term maintenance of these devices. Additionally, it is important for manufacturers to take responsibility for the security of their products, regardless of their age.

It is recommended that Wemo Mini Smart Plug V2 owners ensure their device is not configured to be accessed from outside their network. They should also make sure that the Universal Plug and Play (UPnP) feature on their router is disabled, as it can create vulnerabilities that can be exploited by cyber actors.

As for companies that produce IoT devices, it is essential to prioritize security during the development process. They should implement robust threat modeling, comprehensive testing, and regular security updates to ensure both new and existing products remain secure. Denying the patching of critical vulnerabilities in end-of-life products creates serious risks and should be avoided.

The Belkin Wemo Smart Plug V2 incident highlights the need for better cybersecurity laws that will hold companies accountable for the security of their products. It is essential to have a regulatory framework that ensures the long-term security of these devices. Fortunately, policymakers worldwide are increasingly aware of the risks posed by insecure IoT devices and are working on regulations that will improve the cybersecurity of these products.