How Smart Homes Get Hacked and Whether a VPN Helps

Cybersecurity Awareness Month is coming to an end, and this time looking at smart homes and things: speakers, vacuums, cameras, and even lawnmowers. We’ve collected recent incidents and worked out where a VPN helps and where it doesn’t.

TL;DR

Smart devices — speakers, cameras, locks, vacuums — expand the “attack surface”: open ports, cloud accounts, and vulnerable firmware, most of which the user doesn’t control.
Four categories of risk: a device visible from the internet with firmware that can’t be updated; holes left by the manufacturer itself; surveillance by default; dependence on someone else’s cloud. From 2015 to 2025, there were about 45,000 IoT vulnerabilities (18% of the total amount).
Why are they being hacked: to run criminal traffic through your IP (botnets, NAS, ADB boxes), to collect data and serve ads (Smart TVs send telemetry even after you turn it off in the menu), to cause direct damage (forced defrosting of Danfoss refrigerators across hundreds of stores), and to spy (Yarbo lawnmowers with a single root password, 7,000 DJI vacuums via an authorization flaw, Wi-Fi radars).
Three basics of protection: change factory passwords, hide devices behind your own VPN entrance instead of open ports, and turn off UPnP and port forwarding.
Home VPN access hides devices from scanners: the simplest option is mesh overlays (Tailscale, NetBird, ZeroTier, Headscale), especially with CGNAT; the harder ones are a VPN on the router, on a home NAS/mini-PC, or your own VPS as a “bridge.”
What a VPN won’t help with: buggy firmware, manufacturer surveillance, and hacks of the manufacturer’s cloud — those are closed off only by choosing a reliable vendor and timely updates.

The Smart Home Is Always with You

Voice speakers turn on the lights, start vacuums, and even warm up cars in winter. IP intercoms and smart locks let you let in a repairman or courier remotely. Developers are increasingly building such systems in at the construction stage.

But remote access to your devices means ports on the router open for them, or a connection to the manufacturer’s cloud. This creates additional points of failure: vulnerabilities in the manufacturer’s cloud infrastructure and holes in the devices’ firmware. IoT devices are also a reason to worry about protecting session tokens and isolation within the home network.

The security of your smart home depends on a number of parameters besides the passwords you’ve set. And most of them you don’t control.

Attack Vectors: Four Categories of Risk

The attack surface is all the points through which someone can reach your devices: open ports, passwords, cloud accounts, apps. The more connected devices there are, the wider it is.

The four most common vulnerabilities in your smart home:

The device is visible from the internet, and its firmware isn’t updated. A bot finds it by an open port or a vulnerability.
The hole was left by the manufacturer itself. A single password for all devices, or weak owner verification in the cloud.
The device spies on you by default. TVs, speakers, and vacuums with cameras and microphones send data to the manufacturer.
The device depends on someone else’s cloud. A failure on the server side, and the thing stops working.

Why Smart Homes Get Hacked

From 2015 to 2025, researchers counted almost 45,000 vulnerabilities related to IoT devices — almost 18% of all the holes published in that period.

Often, attackers don’t even need an exploit. Manufacturers that roll out universal security settings to all their devices essentially do the heavy lifting for the criminals. The latter most often pursue one of four goals.

To Route Criminal Traffic Through Your Devices

Operators of botnets and shadow proxies hack your IoT devices to use your IP address for pushing criminal traffic. Recent examples:

NAS and video recorders. GreyNoise specialists found hundreds of hacked devices — including D-Link, Ubiquiti, Hikvision, and Dahua — with known vulnerabilities. The attackers installed the Pawns.app application on network equipment, turning home devices into a marketplace for other people’s traffic.
Boxes with open ADB. Researchers from Plume found that on some Android-based TV boxes the protection is disabled and the ADB debugging port sticks out into the external internet. This lets attackers run traffic through these devices under victims’ IPs.

To Serve Ads and Collect Data

When it comes to marketing activities, IoT device vendors don’t even need to hack you — they collect commercial data through official firmware.

Surveillance via Smart TVs. Northeastern University researchers recorded suspicious telemetry and tracking traffic on TVs even after they fully turned off data collection in the devices’ menus. Among the most “curious” firmware: VIDAA OS, Tizen OS, Google TV OS, SmartCast OS, webOS, Roku OS, and Fire TV OS.

To Cause Direct Damage, Especially in a Business Context

If attackers have targeted you specifically or the organization you work for, smart devices are an ideal target for a cyberattack.

Danfoss refrigeration systems. Unknown actors gained access to outdated Danfoss controllers across France and remotely triggered forced defrosting of refrigerators and freezers, heating the systems up to 50°C. The attack hit hundreds of stores, including Intermarché, Netto, Coopérative U, and Metro. The result: damage running into the millions of euros, and the volume of destroyed food into the tons.

To Spy on You

Smart things see and hear far more than you can imagine. Here are examples of the loudest hacks from 2026 alone:

Yarbo lawnmowers. Researcher Andreas Makris found that the devices have a single root password hardwired in, which resets to the factory one after every firmware update. Using the vulnerability, Makris remotely drove at a journalist from The Verge, controlling the lawnmower from Germany. The hole also opens access to video from the cameras on the device, transmits the home’s exact coordinates, and even reveals the Wi-Fi password.
DJI Romo vacuums. Engineer Sammy Asdufal unexpectedly gained access to more than 7,000 vacuums around the world. The culprit was a cloud authorization flaw in which one device’s token worked for all of them. The damage: leaked data, including apartment maps, audio, and video.
Wi-Fi radars. Experimental open-source tools prove that standard routers and modules like the ESP32 can turn radio waves into 3D models of moving objects. This way, attackers can track your every move without a single camera.

Three Basics of a Secure Smart Home

Change factory passwords. On every device and in the app you use to manage them. Check whether the new password resets after an update, as in the Yarbo case.
Hide devices from the internet. Instead of opening ports for cameras, recorders, and controllers, leave a single entrance — your own VPN server — and get into your home network through it. We break down how this can work below.
Don’t set up a port for every device. Turn off UPnP and port forwarding: every open gateway is a door that bots will knock on.

Home VPN Access Instead of Open Ports

There’s a way to hide smart devices from the internet so that the scanners probing every address around the clock don’t see them, and there’s no access to them from outside.

Important: this method won’t make the devices themselves safe. It won’t patch buggy firmware, as in the Yarbo and DJI cases, won’t stop data collection by the manufacturer — as in Smart TV operating systems — and won’t isolate an infected device on your home network

We suggest connecting to your home network through a secure channel and managing devices from there, rather than forwarding ports manually. From the outside, only the entry point is visible, and only you get inside.

In most cases, a mesh overlay like Tailscale, NetBird, ZeroTier, or self-hosted Headscale is enough. As of publication, this is the simplest working method, especially if you don’t have a public “white” IP and your provider hands out addresses through CGNAT.

A mesh overlay connects your devices directly, automatically punching through NAT, and if a direct connection doesn’t work out, it routes traffic through a relay. You divide access by device and open only the resources you need.

If you want full control and no third-party services, there are more complex options:

A VPN server on the router — we’ve prepared instructions for Keenetic and Netcraze, as well as models on OpenWrt firmware.
A VPN server on a home device (a mini-PC or NAS) — flexible, but it has to run around the clock, and with CGNAT it won’t help on its own without a public IP.
Your own VPS as a “bridge” — for the case without a public IP. The home network itself establishes an outgoing connection to the server, which passes through NAT, unlike an incoming one, and you connect to that server. Essentially, it’s a manual version of what a mesh overlay does for you.

A checklist before rolling out these methods:

Whether you have a public IP or are behind CGNAT — this determines whether a router/home server is enough or you need an overlay or a bridge.
Whether your devices can be managed locally at all. Many cameras, speakers, and controllers are tied to the vendor’s cloud and don’t work over a local IP.
Whether the ports are closed from outside after setup. Check your external IP with an online port scanner from a mobile network (not from home).
Whether you update the entry point. The router, home server, or overlay nodes become the new target; their vulnerabilities are exploited just like any others.

What a VPN Won’t Help With

Choice of manufacturer. Vulnerabilities like those found in Yarbo and DJI can’t be fixed on your end. Find out how the manufacturer responds to vulnerability reports and how long the company releases updates (if it responds at all).
Updates. Try to install patches promptly, at least once every three months. The Danfoss and GreyNoise cases are the exploitation of old vulnerabilities that users don’t close themselves.
Compromise on the vendor’s side. If the cloud your Smart TV connects to is hacked, a VPN tunnel won’t save you.

Managing Risks in the Smart Home

Some vulnerabilities — passwords, open ports, updates, the number of devices that face the internet at all — you do control.

But some factors, such as holes in firmware, surveillance by default, and the security of the manufacturer’s cloud, you can’t influence.

VPN access strengthens the first part — it hides devices and removes unnecessary entry points. The second is closed off only by caution: which vendor to trust and what to connect in your home in the first place.