Consumer IoT cybersecurity under the EU CRA and ETSI EN 303 645

For makers of connected consumer products — cameras, smart-home hubs, routers, wearables — sold in the EU, UK or elsewhere. The EU Cyber Resilience Act, ETSI EN 303 645 and the UK PSTI regime set baseline requirements: no default or weak passwords, a vulnerability-disclosure process, and timely security updates. SoftWSP's Device & Firmware Security service scans your firmware, builds the SBOM and finds the issues these rules are written to catch.

Regulations and standards that apply

• EU Cyber Resilience Act — Regulation (EU) 2024/2847. SBOM, vulnerability-handling and Article 14 reporting duties for products with digital elements, which covers most connected consumer devices placed on the EU market.
• ETSI EN 303 645. The widely referenced consumer IoT baseline: no universal default passwords, a published vulnerability-reporting channel, a defined security-update period, and secure storage of credentials — the basis several national schemes build on.
• EN 18031 / RED delegated act. For radio equipment (Wi-Fi, Bluetooth, cellular — most consumer IoT), Commission Delegated Regulation (EU) 2022/30 and the EN 18031 harmonised standards add network, privacy and fraud-prevention requirements under the Radio Equipment Directive.
• UK PSTI regime. The Product Security and Telecommunications Infrastructure Act 2022 bans universal default passwords and sets minimum security requirements for consumer connectable products sold in the UK.

Typical device and firmware risks

• Missing authentication on a camera or hub's local web service, letting anyone on the network view a live feed, as found in a real 2026 advisory on a consumer security camera.
• Hard-coded or shared credentials baked into firmware, as found in a real 2026 advisory on a consumer IP camera's cloud firmware.
• Stack or heap buffer overflows in router or gateway firmware reachable without authentication, as found in a real 2026 advisory on a consumer router.
• Outdated open-source components (TLS libraries, web servers) bundled into the firmware and never updated after the device ships.
• No published way for a researcher to report a vulnerability, and no update mechanism once one is found.

Which SoftWSP service fits

Device & Firmware Security scans your firmware image, even without source code, builds the SBOM and checks for the exact issues EN 303 645, EN 18031 and PSTI name: default credentials, open debug services, unsigned updates and outdated components, with findings prioritised by CISA KEV and FIRST EPSS.

Related

• ETSI EN 303 645: consumer IoT security
• CVE-2026-107607: Swann SWIFI-SE2KIC missing authentication
• CVE-2026-107617: EseeCloud hard-coded credential