Attacker within WiFi range can install arbitrary firmware over the air on unconfigured units

An attacker located within the WiFi range of an unconfigured (i.e., not connected to the cloud) unit can communicate with the unit and cause the unit to connect to a malicious WiFi, that will redirect the unit to a malicous update server upon boot.

The malicious update server can be used to return arbitrary firmware that will be flashed onto the device.