> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Appliances - URL: https://www.ostering.com/taxonomies/smart-home/oph-appliances/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:52:35.598Z - Description: Appliances: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Appliances (OPH-AP) Ovens and hobs, washing machines, fridges and freezers, robot vacuums and mowers, televisions and water heaters. Connecting them adds remote commands to machines that heat, spin, cut and see. ## Where it sits in the house The Appliances suit sits in the kitchen, the laundry, the living room and the garden. It is suit 6 of 13, in the Things deck. ![Appliances highlighted on the Open House cross-section](https://www.ostering.com/media/posts/147/smart-home-06-appliances-where-it-sits-1600x900.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Appliances: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/147/smart-home-taxonomy-table-06-AP.png =1200x2918) ### Mappings ![Appliances: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/147/smart-home-mapping-table-06-AP.png =1200x1105) ### Entries in text - **OPH-AP-A † Oven Lit Remotely.** An oven, hob, kettle or tumble dryer can be started from the app or cloud with nobody home, so a stolen account, a bug or a mistaken tap starts a fire. - **OPH-AP-K † Safety Limit in Software Only.** Over-temperature and pressure limits (water heaters, dryers, ovens) live in updatable firmware rather than an independent cut-out, so malicious firmware or a bad update removes them. - **OPH-AP-Q † Mower Starts with the Children Out.** A robot mower or pool cleaner starts on a remote command or schedule without anyone seeing the area, with children or pets in it. - **OPH-AP-J † Child Lock Bypassed by App.** The appliance's physical child lock does not apply to commands from the app, cloud or voice assistant, so they start a machine a child can reach. - **OPH-AP-10 Vacuum Maps the House.** Robot vacuums with cameras and LiDAR build floor plans and take pictures inside the home, which go to the cloud, to training sets and to contractors. - **OPH-AP-9 Appliance as Foothold.** A fridge or television with an old Linux or Android build sits on the main network, so an attacker uses it as a foothold to reach the hub and the household's computers. - **OPH-AP-8 Service Mode Password.** A hidden service mode, reached by a button sequence or a service app with a hard-coded password, lets anyone change parameters, including safety settings. - **OPH-AP-7 TV Watches Back.** Smart televisions recognise what is on screen and listen for voice commands, and send viewing data to advertisers and data brokers. - **OPH-AP-6 † Started Without Being Ready.** A washing machine or dishwasher starts on a remote command with the door open, the hose loose or the load wrong, and floods the kitchen with nobody home. - **OPH-AP-5 Freezer Off Without a Word.** A rule, scene or remote command turns off a fridge or freezer, or changes its temperature, and nothing tells the household until the food has spoiled. - **OPH-AP-4 Setup Hotspot Left Open.** The appliance's setup hotspot stays open, or reappears with a default password, so someone nearby re-provisions it or captures the home Wi-Fi password. - **OPH-AP-3 † Recipe Drives the Heat.** Ovens and cooking machines run programs downloaded from the cloud or a community, so a malicious or broken program sets temperatures and times the user never saw. - **OPH-AP-2 Usage Data Shows the Routine.** Appliance usage (cooking times, laundry, coffee, vacuum runs) is collected and shared, and shows when the household wakes, eats and goes out. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild - **OPH-AP-10 Vacuum Maps the House.** iRobot development-robot images leaked by data-labelling contractors (MIT Technology Review, 2022). [A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook? (MIT Technology Review, Dec 2022)](https://www.technologyreview.com/2022/12/19/1065306/) - **OPH-AP-7 TV Watches Back.** FTC settlement with Vizio (2017). [Vizio settles for $2.2 million in FTC suit over snooping on consumers' viewing habits (TechCrunch, Feb 2017)](https://techcrunch.com/2017/02/06/vizio-settles-for-2-2-million-in-ftc-suit-over-snooping-on-consumers-viewing-habits/) --- ← Previous: [Alarms and Locks](https://ostering.com/taxonomies/smart-home/oph-alarms-and-locks/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Energy](https://ostering.com/taxonomies/smart-home/oph-energy/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*