An educational robot security research

**Executive Summary:** Research into an Android-based educational robot revealed multiple critical vulnerabilities — plaintext/weak authentication and low-entropy device IDs enabling data enumeration, unauthenticated Agora token issuance allowing remote video/camera access to any device, weak OTP authentication permitting parent-account hijacking, and an unsigned update process enabling remote code execution as root — exposing children's privacy and safety; the vendor was notified and issued fixes.