What possible reason is there to have a coffee machine connected to the Internet? And if you really need to do so, why have it run on a full-blown Windows XP? Some smart people are remarkably stupid.

It dosen't. (run xp). It's a high end, automatic-everything espresso maker, and it's got a connection that lets you plug it into a computer running windows XP. There's a software package you run on the computer to talk to the coffeemaker. That's what has the vulnerability.

The reason for the connection is a) to let the user change the machine's presets, and b) to allow a repair tech to log in over the internet to do remote diagnostics on this (complicated, and expensive) bit o' kit. Still, the manufacturer should have known better than to neglect security like that. High end equipment, like photocopy machines, have been doing remote diagnostics for years, and have been getting compromised via the diagnostic ports for as long. If it has a connection to a public net, you need to pay attention to security.

Tha's nothing, my old fridge had been downloading pr0n from the internet for years. I thought the modem bill was a bit high for telling Sainsbury's I needed more beer.

(That's my story and I'm sticking to it.)

Kevin, did you check your fridge for gay hobbits?

I can see a lot more reason to have a refrigerator on-line than a coffeemaker. Beer is always running low, and the pr0n has to be refreshed. Really, how often do you need to change the presets on a coffeemaker? Besides, I'll bet the display quality on the coffeemaker is inferior!