MITM stands for man-in-the-middle. It is an attack in which an adversary positions themselves between two systems, such as a browser and a server or a router and an update service, so they can intercept, relay, or modify traffic without either side realizing it.
MITM matters because many security controls depend on trust in the connection. If certificate validation, authentication, or integrity checks are weak, a device may accept spoofed data as legitimate. In real attacks, a MITM position can be used to steal credentials, inject malicious commands, downgrade encryption, or tamper with firmware and update traffic. Defenders reduce this risk by enforcing strong TLS validation, using trusted certificates, signing updates, and limiting exposed management interfaces so hostile interception is harder to exploit.