Attacker within WiFi range can cause unconfigured units to connect to a malicious update server

An attacker located within the WiFi range of an unconfigured (i.e., not connected to the cloud) unit can communicate with the unit and cause the unit to connect to a malicious WiFi, that will redirect the unit to a malicous update server upon boot.

The malicious update server can be used to return arbitrary firmware that will be flashed onto the device.