Smart Home Vulnerabilities: Studying the Security Risks and Unauthorized Access Considerations Inherent to Everyday IoT Devices

Abstract

Background: Smart home ecosystems integrate Internet of Things (IoT) devices—cameras, door locks, voice assistants, thermostats, and lighting controllers—into residential networks that process sensitive personal data and control physical access. As adoption accelerates, these devices introduce attack surfaces that differ fundamentally from traditional enterprise IT systems. Objective: This study systematically examines security risks and unauthorized access vectors affecting consumer-grade smart home IoT devices. Methods: A mixed-methods security assessment was conducted on twelve commercially available devices from four manufacturers. The methodology combined passive network traffic analysis, firmware inspection, automated vulnerability scanning with Nmap and OpenVAS, manual penetration testing guided by the OWASP IoT Top 10, and a structured review of 47 peer-reviewed publications published between 2020 and 2025. Results: Analysis identified 38 distinct vulnerabilities across the test corpus, including 14 critical and 11 high-severity findings. Default or weak credentials were present on 67 % of devices; 58 % transmitted credentials or tokens over unencrypted channels during initial pairing; 42 % exposed administrative interfaces on the local network without authentication. Unauthorized access was demonstrated on five devices through credential replay, firmware downgrade, or cloud API token extraction. Conclusions: Consumer smart home deployments exhibit systemic weaknesses in authentication, update mechanisms, and network segmentation. The study contributes a reproducible assessment framework and evidence-based mitigation recommendations for homeowners, manufacturers, and policymakers seeking to reduce unauthorized access in residential IoT environments.