Your router may be the weakest link in a home full of smart devices

Routers account for more than three-quarters of attacks on connected devices, while flaws in appliances and cars show how quickly convenience can become a security risk.

Connected devices can make daily life easier, but they also widen the attack surface in the home. As Reuters reported, anything linked to the internet and controlled remotely can be probed by hackers, from cameras and alarm systems to thermostats, smart locks and even appliances such as fridges, ovens and washing machines. The basic risk is simple: once a device is online, it may expose data, provide a foothold into a wider network, or both.

That concern is not hypothetical. In August 2015, researchers demonstrated at the Defcon security conference that a Samsung smart refrigerator could be exploited because it failed to properly validate SSL certificates, opening the door to man-in-the-middle attacks and possible theft of Gmail credentials. Security researchers later repeated that finding, describing how the fridge’s calendar integration could be intercepted if traffic was manipulated. The episode became an early warning that internet-connected appliances often inherit software flaws that were once associated mainly with laptops and phones.

Routers remain the most important weak point. Security-industry data cited by Reuters shows that routers account for more than three-quarters of attacks on connected devices, a reminder that the network gateway is often the easiest route into a home or small office. A 2025 Zscaler ThreatLabz report reached a similar conclusion, saying routers were the most targeted IoT devices and that attackers commonly use them to run commands, spread malware and build botnets. In practical terms, a compromised router can reveal traffic moving across a network, not just information from one appliance.

The risk is not limited to household gadgets. Reuters noted that researchers have repeatedly shown vulnerabilities in connected vehicles, including a 2015 case in which a moving Jeep was remotely controlled through its internet-connected entertainment system, prompting a large recall and software fixes. More recently, researchers disclosed flaws affecting certain Kia models, including the ability to track, unlock and start vehicles using only a licence plate number; the researchers said they had reported the issue and that it was fixed within months. By contrast, critical infrastructure such as power and water systems usually has deeper layers of security and monitoring than consumer devices, which makes them harder targets even if they are not immune to attack.

For most households, the strongest defences are still the simplest. Cybersecurity experts recommend changing default passwords, turning on two-factor authentication where it is available and installing updates as soon as they are released. Devices that no longer receive security patches should be removed or replaced, and products should stay on a local network unless there is a clear need for them to reach the wider internet. The fewer connected devices in a home, the fewer possible entry points an attacker can exploit.