Comment by cromka

Inspired by this article I started to work on migrating my cat's feeder to ESPHome. Within 2 mere hours I'm am basically done but also wanted to RE their update path to avoid having to connect to UART to flash the new firmware. To my surprise, the stock firmware has some issue with the vendor's server where it downgrades to plain HTTP after 5 retries. It exposes all keys, device id and firmware upgrade path to MITM attacks. Absolutely bonkers and it shows how bad these IoT companies are at security.

Vendor is PetKit btw.