Appliances

November 5, 2026

Smart Home Threat Taxonomy › Appliances (OPH-AP)

Ovens and hobs, washing machines, fridges and freezers, robot vacuums and mowers, televisions and water heaters. Connecting them adds remote commands to machines that heat, spin, cut and see.

Where it sits in the house

The Appliances suit sits in the kitchen, the laundry, the living room and the garden. It is suit 6 of 13, in the Things deck.

Appliances highlighted on the Open House cross-section

The table

Smart Home Threat Taxonomy, Appliances: ID, threat, mitigation principle and design measures for all 13 entries

Mappings

Entries in text

OPH-AP-A † Oven Lit Remotely. An oven, hob, kettle or tumble dryer can be started from the app or cloud with nobody home, so a stolen account, a bug or a mistaken tap starts a fire.
OPH-AP-K † Safety Limit in Software Only. Over-temperature and pressure limits (water heaters, dryers, ovens) live in updatable firmware rather than an independent cut-out, so malicious firmware or a bad update removes them.
OPH-AP-Q † Mower Starts with the Children Out. A robot mower or pool cleaner starts on a remote command or schedule without anyone seeing the area, with children or pets in it.
OPH-AP-J † Child Lock Bypassed by App. The appliance’s physical child lock does not apply to commands from the app, cloud or voice assistant, so they start a machine a child can reach.
OPH-AP-10 Vacuum Maps the House. Robot vacuums with cameras and LiDAR build floor plans and take pictures inside the home, which go to the cloud, to training sets and to contractors.
OPH-AP-9 Appliance as Foothold. A fridge or television with an old Linux or Android build sits on the main network, so an attacker uses it as a foothold to reach the hub and the household’s computers.
OPH-AP-8 Service Mode Password. A hidden service mode, reached by a button sequence or a service app with a hard-coded password, lets anyone change parameters, including safety settings.
OPH-AP-7 TV Watches Back. Smart televisions recognise what is on screen and listen for voice commands, and send viewing data to advertisers and data brokers.
OPH-AP-6 † Started Without Being Ready. A washing machine or dishwasher starts on a remote command with the door open, the hose loose or the load wrong, and floods the kitchen with nobody home.
OPH-AP-5 Freezer Off Without a Word. A rule, scene or remote command turns off a fridge or freezer, or changes its temperature, and nothing tells the household until the food has spoiled.
OPH-AP-4 Setup Hotspot Left Open. The appliance’s setup hotspot stays open, or reappears with a default password, so someone nearby re-provisions it or captures the home Wi-Fi password.
OPH-AP-3 † Recipe Drives the Heat. Ovens and cooking machines run programs downloaded from the cloud or a community, so a malicious or broken program sets temperatures and times the user never saw.
OPH-AP-2 Usage Data Shows the Routine. Appliance usage (cooking times, laundry, coffee, vacuum runs) is collected and shared, and shows when the household wakes, eats and goes out.

† marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the downloads.

Seen in the wild

OPH-AP-10 Vacuum Maps the House. iRobot development-robot images leaked by data-labelling contractors (MIT Technology Review, 2022). A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook? (MIT Technology Review, Dec 2022)
OPH-AP-7 TV Watches Back. FTC settlement with Vizio (2017). Vizio settles for $2.2 million in FTC suit over snooping on consumers’ viewing habits (TechCrunch, Feb 2017)

← Previous: Alarms and Locks · All suits · Next: Energy →