Abstract The Internet of Things (IoT) encompasses a network of devices equipped with sensing, computing and actuating capabilities, leading to a surge in cybersecurity vulnerabilities that threaten personal security and public safety. Addressing vulnerabilities is essential for ensuring IoT security. In this Review, we provide a comprehensive overview of IoT device vulnerabilities and countermeasures, contrasting their characteristics with traditional computer vulnerabilities. We highlight that IoT device vulnerabilities are often complex and have far-reaching implications, owing to their deep integration with the physical and cyber domains. We propose a new taxonomy that categorizes IoT device vulnerabilities into in-band and out-of-band classifications, emphasizing emerging out-of-band vulnerabilities. We discuss advancements in vulnerability management technologies, including identification, assessment, remediation and mitigation. Our analysis highlights the need to extend beyond cyber-centric security paradigms to incorporate countermeasures that address cyber–physical interactions. We conclude by outlining future research directions, including generalizable vulnerability models, scalable identification pipelines, secure-by-design architectures and resilience for emerging systems. Key points - The characteristics of Internet of Things (IoT) devices differentiate their vulnerabilities in cybersecurity from those of traditional computers, bringing new challenges to addressing vulnerability in the IoT era. - The emerging out-of-band vulnerabilities in IoT devices pose risks from the anomalous conversion between the physical signals and cyber information and call for the attention of researchers to address such vulnerabilities. - It is essential to integrate a complete vulnerability management life cycle involving identification, assessment, remediation and mitigation, with an emphasis on building IoT vulnerability databases as the cornerstone. - Vulnerability identification is evolving to address emerging and varying IoT vulnerabilities by integrating artificial intelligence technologies and targeting the signal-information conversion of IoT devices. - Threats to IoT devices increasingly involve the simultaneous exploitation of multiple vulnerabilities. Remediation and mitigation must not only balance security and usability but also address the