Electra Central AC
Electra Central AC Smart WiFi Controller v7
Electra Central AC Smart WiFi Controller v8
An attacker located within the WiFi range of an unconfigured (i.e., not connected to the cloud) unit can communicate with the unit and cause the unit to connect to a malicious WiFi, that will redirect the unit to a malicous update server upon boot.
The malicious update server can be used to return arbitrary firmware that will be flashed onto the device.