Smart TVs Lead Vulnerability Count As Average Home Hits 24 Connected Devices

The average household now has 24 connected devices, up from 22 last year and the one sitting in the living room is the most exposed of the lot.

Smart TVs account for 22.7 per cent of all vulnerability observations across roughly 10.4 million smart homes worldwide, according to the 2026 IoT Security Landscape Report published jointly by cybersecurity firm, Bitdefender, and networking vendor, Netgear.

The report draws on 5.4 billion security events and 6.2 billion vulnerability observations collected from January through September 2026 across routers protected by Bitdefender’s smart-home security technology. It paints a picture of homes where everyday devices are no longer just targets for attack but can serve as proxies, sensors and footholds into the wider network.

Smart TVs, smart plugs and network-attached storage (NAS) devices together account for 67.1 per cent of all vulnerability observations – a concentration driven not by any single chipset or vendor but by the gap between how long these devices stay in homes and how quickly their manufacturers stop issuing security updates.

One device, four problems

The report frames the IoT threat landscape around four roles that a single compromised device can play simultaneously. A vulnerable device can be a target for direct attack, a proxy that relays third-party traffic through the household’s internet connection, a sensor that gathers information about the physical environment, or a foothold that provides persistent access to the broader home network.

Smart TVs are where all four roles converge. They generated 270.3 million vulnerability observations across the reporting period – the largest count of any device category.

Senior Vice President of Operations at Bitdefender Consumer Solutions Group, Ciprian Istrate, warned that the growth in connected devices has turned homes into complex digital ecosystems where every new addition gives attackers another way in.

“Cybercriminals are using AI to speed attacks on newly discovered vulnerabilities from days to a matter of hours, putting families at far greater risk,” Istrate added. “Our research with Netgear shows that router-level protection is now critical for defending against malware, identity theft, and increasingly sophisticated scams.”

Head of Product and Cybersecurity at Netgear and Member of the CVE Board, Chandan Nandakumaraiah, pointed to a shift in attacker focus. As enterprises improve their defences, criminals are turning to connected home devices because they are always on, rarely monitored and occupy trusted positions within home networks.

The television’s second job

Beyond conventional vulnerabilities, the report highlights a growing concern around proxy software bundled into smart TV apps. Software development kits (SDKs) packaged with free apps on several app stores open a local proxy listener on the television, allowing the household’s broadband connection to carry third-party traffic for purposes such as AI web scraping, ad verification and market research.

The report notes that this is not malware in the traditional sense. Users accept consent language when installing the app, and providers present the arrangement as consented infrastructure. But it raises the question of whether a one-time end-user licence agreement click on a free app constitutes informed consent to turn a television into an exit node for someone else’s internet traffic.

A television relaying third-party traffic shares its IP reputation with everything it carries. The household bears the address that the outside world sees.

The U.S. Department of Justice dismantled four IoT botnets during the reporting period, including operations that had compromised more than a million devices. The report draws a line between criminal botnets like BADBOX, which stole bandwidth without consent, and the SDK model, which purchases it cheaply from users who may not understand what a residential proxy is.

Separately, the report references findings that LG smart TVs may collect data including voice recordings, details about other devices on the local network, geographical location and nearby wireless networks – with collection potentially continuing even when the TV appears to be switched off. LG-branded devices alone carried 197.4 million CVE observations, representing 16.6 per cent of the total.

Cheap plugs and ageing storage

Smart plugs ranked as the second most vulnerable device category, accounting for 22.4 per cent of vulnerability observations with 266.7 million records. The economics of these devices explain the security picture: a smart plug is the cheapest networked computer a household will buy, and manufacturers’ margins leave no budget for a sustained patching programme. End of sale typically means end of support.

These devices then stay in the wall for years, streaming no video and running no apps, simply holding an IP address behind a trusted residential connection. That profile – idle compute behind a household address – is precisely what botnets and proxy networks seek.

Network-attached storage devices rounded out the top three at 22 per cent of observations, with 261.6 million records. Three vendor lines – WD MyCloud, Synology and QNAP – held 18.7 per cent of all observations between them. NAS devices are built to be accessible, with full server stacks, file and media services, remote-access features and admin panels often running on kernels years behind current releases. The National Vulnerability Database logged 48 QNAP CVEs and 13 Synology CVEs in 2026 through late September.

The report characterises the NAS as a particularly attractive target for ransomware operators: it holds the only copy of the family photo library, runs around the clock and sits inside the local network with reach to everything else.

Phones remain the most common device on home networks, accounting for 20.4 per cent of identified devices, followed by TVs at 10.6 per cent, computers at 10 per cent, network equipment at 6.2 per cent and streaming devices at 5.4 per cent.

Reconnaissance dominates the attack stream

The overwhelming majority of detected attack activity was automated scanning. Reconnaissance accounted for 90.1 per cent of the 5.4 billion attack-category events, with 4.85 billion port scan attempts recorded across the nine-month window – an average of 19.2 million per day. The typical home router recorded roughly two port scan attempts every day for the entire monitoring period.

Password brute-forcing came a distant second at 8.7 per cent of the attack stream, with 466.6 million events. Of those, 455 million targeted RDP, the Windows remote-desktop service, representing 97.8 per cent of all protocol-level password guessing. SSH, FTP, HTTP, SMB, Telnet and Kerberos shared the remainder.

Actual exploit attempts – matched patterns for attacks like command injection – appeared 91,846 times across the entire dataset, amounting to just 0.002 per cent of the stream.

Nearly all observed device vulnerabilities – 99.97 per cent – were publicly known Common Vulnerabilities and Exposures (CVEs), rather than weak passwords or plaintext authentication issues. Overflow errors accounted for about 54 per cent of potential attack outcomes, followed by denial of service at roughly 18 per cent and memory corruption at about 17 per cent. The outcomes that give attackers direct control of a device or its data – privilege escalation, code execution and information disclosure – were far less common, combining for about 10.3 per cent of the total.

The report notes that nearly half of all CVE observations – 46.9 per cent – scored exactly 7.8 on the CVSS severity scale, a pattern it attributes to a small number of common consumer firmware baselines that are scored once and inherited across devices at scale.

What households can do

The report offers several practical recommendations. It advises updating home routers at least twice a year on a set schedule, noting that the router is the perimeter from which the entire report is measured and that firmware that never updates is the single largest avoidable risk.

Devices past their support window should be retired, particularly cheap ones. The report argues that a $20 smart plug past its end of life is not an heirloom but a liability, since the plug and TV classes dominate vulnerability charts precisely because they outlive their patch windows.

NAS devices should be kept off the open internet entirely, with no exposed admin panels and UPnP disabled at the router. Default passwords should be replaced with unique credentials across all devices.

Looking ahead, the report forecasts three trends for 2027. Residential proxy operators are expected to expand distribution through inexpensive Android TV boxes, sideloaded apps and connected devices with less restrictive software ecosystems. Shared firmware components across multiple brands are likely to produce cross-vendor vulnerability disclosures. And smart-home privacy investigations are expected to follow data flows across devices and linked consumer accounts, rather than examining individual permissions in isolation.

The data in the report originates from Bitdefender’s proprietary telemetry systems and reflects only what the company was able to observe through its own infrastructure. The figures should be read as indicative markers rather than exact measurements, the report notes.

Last Updated on October 30, 2026 by Nick Ross