Bitdefender telemetry from 10.4 million home routers found televisions and smart plugs accounted for almost half of observed IoT vulnerabilities, while billions of automated scans probed household networks.
Smart televisions and connected plugs emerged as two of the most exposed device categories in Bitdefender’s 2026 IoT Security Landscape Report, which analysed telemetry from roughly 10.4 million protected home routers between January and September. The report said televisions accounted for 22.7% of observed vulnerabilities, while smart plugs made up 22.4%, underscoring how common household gadgets can remain online long after their security support has faded. Bitdefender and NETGEAR said smart TVs, smart plugs and network-attached storage systems together represented 67.1% of vulnerability observations across the connected home.
The report also suggests that the threat landscape inside the home is being shaped less by sophisticated intrusions than by constant, low-level probing. Automated port scans made up 90.1% of all detected attack-category events, with about 4.85 billion scan attempts recorded during the nine-month period. These scans look for open remote access or administration services, but Bitdefender said they do not by themselves prove a successful compromise. Password brute-force activity was the other major category, accounting for about 8.7% of events, with the overwhelming majority aimed at Remote Desktop Protocol.
The figures help explain why connected devices can become difficult to manage over time. Bitdefender said many household electronics remain in service for five to ten years, while software support may last only two to four years. Once updates stop, products such as televisions, plugs and storage devices can keep operating while carrying unresolved flaws. The report also pointed to evidence cited from Spur showing that software bundled with some free smart-TV apps can turn televisions into residential proxies once users agree to the terms, allowing third-party traffic to pass through a household internet connection.
That creates multiple risks at once: a device can be a target, a relay for outside traffic, a sensor collecting data, or a foothold within the home network. The report cited findings from Gamers Nexus showing that some LG televisions can collect viewing information, voice recordings, location data, details of devices on the local network and information about nearby wireless networks. Bitdefender said Automatic Content Recognition can be used to identify what appears on a screen for advertising purposes. “Once inside, criminals can stay hidden and move laterally across the home network,” warned Chandan Nandakumaraiah, head of product and cybersecurity at NETGEAR.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
