Connected air conditioners pose rising cyber security threat as devices become more vulnerable

Experts warn that connected air conditioners, increasingly embedded with microphones and cameras, are becoming a overlooked entry point for cyber attacks, exposing household networks to new vulnerabilities.

Connected air conditioners are becoming an overlooked route into home networks, according to Святослав Литвинов, a technical sciences candidate and acting head of telecommunications at RTU MIREA, as reported by Life.ru. His warning is that once a climate-control unit is online, it is no longer just an appliance: it is a small computer that may sit inside the same network as phones, laptops and banking apps. Some models also include microphones, cameras and voice control, which increases the attack surface if the device is poorly protected.

The main risks are familiar but often ignored. Weak or unchanged factory passwords, outdated firmware and loose router settings can allow an intruder to take control without drawing attention. Ecotemphvac, which reviewed smart air-conditioning security, said poor encryption and weak network design are recurring problems, while TechRadar has noted that an exposed smart device can become a bridge to others on the same Wi‑Fi network. In practice, that can mean surveillance of connected devices, data theft or unauthorised access to household systems.

The danger is not theoretical. Ecotemphvac cited the 2022 discovery of Electra Smart AC controllers that allowed anonymous logins through an open MQTT server, and it also referred to a 2026 disclosure involving a serious flaw in Mitsubishi Electric systems. Midea has separately issued a security notice for a smart air-conditioner controller vulnerability that could let an attacker bypass authentication through specially crafted requests. SentinelOne has also documented CVE-2026-5667, an authentication-bypass issue tied to hard-coded credentials in Mitsubishi Electric appliances.

Lytvinov’s advice, as relayed by Life.ru, is straightforward: disable microphones and cameras where possible, place smart devices on a separate guest Wi‑Fi network, update firmware regularly and change default passwords on both the appliance and the router. He also recommends checking which devices are connected and rebooting the router if an unknown address appears. The broader point, supported by other security reporting, is that convenience often comes at the cost of visibility. A device that seems harmless may still provide a practical entry point into everything else on the network.