Traeger security bugs bad news for grillers with neighborly beef

Bishop Fox disclosed a high-severity insufficient-authorization vulnerability in Traeger's D2 Wi‑Fi controller registration API (rated 7.1) that can let attackers obtain control of grills—forcing shutdowns or cranking temperatures—and a separate medium-severity (4.3) GraphQL issue that could enumerate registered grills; researchers demonstrated remote shutdown and overheating, and Traeger has issued firmware updates and disabled the ListGrills function to mitigate the issues.