A New Program for Your Peloton – Whether You Like It or Not

McAfee Advanced Threat Research discovered and demonstrated a critical Android Verified Boot bypass (CVE-2021-33887) on Peloton Bike+ devices that allowed modified boot images to be executed via fastboot despite a locked bootloader; the researchers extracted an OTA boot.img, patched it with Magisk to gain root, and showed the potential for persistent compromise, network interception, camera/microphone access, and supply-chain tampering. Peloton issued a patch (PTX14A-290) to mitigate the issue.