Researchers Hack Smart Grill Remotely Using Just a Mobile Device

Researchers discovered critical insufficient-authorization and information-disclosure vulnerabilities in the Traeger Grill D2 Wi‑Fi Controller that allowed attackers who obtain a grill's 48‑bit identifier (via captured pairing traffic or QR scanning) to register the device to an attacker-controlled AWS IoT instance and remotely issue commands (PoC showed temperature changes and shutdown); Traeger released a firmware update that auto-installs on internet-connected devices and disabled the vulnerable GraphQL operation.