The Belkin WeMo switch lets you turn on and off electric sockets over WiFi using an app. Apart from the WiFi password, is there another potential vulnerability of this device that could let an attacker control my socket?


Most of the remotely accessible power strips I've been looking at for a current project have either http or telnet access (no encryption on either) for control so any time you access it, you're sending credentials in the clear.

They are in the IOT minimum security zone, anyone on the local segment can packet-sniff your credentials if they're determined to flip switches. So the only protection you have is often a sniffable password if they don't have the ability to change from a hardwired admin and user account name. And often, no brute force timeout either.

And my experience on contacting the manufacturer about minimal security is "we keep having customers ask these questions, but the unit doesn't really have the processing power to enable (ssh, https, bad login timeout, etc.)

Specific to WeMo, it uses UPnP which has security concerns discussed in this question on security.stackexchange. One of the recommendations to increase router security is to turn off UPnP and manually configure port forwarding.

WeMo had some security issues with its cloud based control, firmware updates and protocol used back in 2014 which have been patched.

Several websites on the internet discuss scripts using curl to post SOAP commands to the WeMo device to control it. That's unencrypted http over whatever port (49152/49153) the device is set to and via UPnP port opened through the router for remote access. No authentication is mentioned in these scripts either, so you use UPnP to open a port for internet access and there's no gatekeeper for toggling the device.

WeMo appears to hide behind a phone/tablet App via a cloud service that requires UPnP to open a forwarded port on your router for communications. Getting any information off their website as to how this communications is protected other than how easy it is to use is proving difficult.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.