Insecure API authentication - Device impersonation - Unauthorized access to device data - Command injection through device management APIs