When directed to manage an IoT device or router using a browser, passwords and all communications are typically passed over an unencrypted connection. This is a security vulnerability which needs attention.