Smart home devices are under fresh scrutiny this week as two separate security findings expose how IoT hardware can turn from convenience into liability. Researchers at elttam disclosed a vulnerability in Home Assistant's FFmpeg integration that could let attackers steal sensitive tokens and execute commands as root, while a Bitsight investigation revealed that cheap Android TV boxes are being repurposed as residential proxies for ad fraud. Both disclosures landed within days of each other — elttam's technical writeup on July 29 and Bitsight's Fuyao report on July 31 — and together they illustrate how the same devices that make homes smarter also expand the attack surface in ways manufacturers rarely anticipate. The findings arrive as smart home adoption continues to accelerate across consumer and enterprise markets.
Home Assistant Flaw Lets Attackers Read Files and Take Over the Host
The vulnerability lives in Home Assistant's Wyoming Assist satellite integration, which handles voice-controlled audio playback. When a paired satellite sends an announcement, the media_id parameter gets passed directly to FFmpeg as the -i input argument without sufficient sanitization, elttam reported on July 29. An attacker who controls a paired satellite and holds a valid Home Assistant API token can inject FFmpeg pseudo-protocols like concat:, file:, and subfile: to construct a synthetic audio header from existing binaries on the device. Once FFmpeg accepts the forged stream, it processes and exfiltrates the target file back to the attacker's satellite.
The most sensitive target is /proc/self/environ, which contains the SUPERVISOR_TOKEN. That token grants access to Home Assistant's Supervisor API, which can execute commands as root on the host operating system. "This gives you full remote code execution on the Home Assistant server," elttam wrote in their technical writeup. The attack chain requires three conditions: a paired Wyoming Assist satellite on the same Layer 2 network, a valid Home Assistant API token, and the ability to trigger the vulnerable announce endpoint. Despite these constraints, the researchers showed the exploit works reliably against Home Assistant OS installations. The elttam team used the /bin/go2rtc binary, present by default on Home Assistant OS, as a reliable source for the synthetic audio header fragments needed to make FFmpeg accept the malicious stream.
Home Assistant patched the issue in version 2026.6.2 by introducing a strict -protocol_whitelist that limits FFmpeg to safe protocols like http, https, file, tcp, and tls. The patch also reorders the arguments so the allowlist applies before the input, preventing the bypass techniques elttam demonstrated. The researchers originally submitted the finding as a full exploit chain for Pwn2Own Ireland 2025, where Home Assistant Green carried a $40,000 bounty, but the submission was closed as N/A after the patch landed. The fix also includes a new unit test that specifically validates the protocol allowlist behavior, confirming the developers took the argument-ordering constraint seriously.
Home Assistant has an estimated two million installations worldwide, making it one of the most widely deployed open-source smart home platforms. Its local-first architecture and support for thousands of devices have made it a favorite among privacy-conscious users, but that same ubiquity makes it a high-value target. The 2023 CVE-2023-27482 authentication bypass in the Supervisor Integration and the Pwn2Own Ireland 2025 submissions all exploited Home Assistant's trusted-network position. Elttam's earlier research on Home Assistant's pre-auth attack surface in 2023 had already flagged the Wyoming integration as a component worth deeper scrutiny.
Android TV Boxes Become Residential Proxies in Fuyao Ad-Fraud Operation
A separate investigation by Bitsight, reported July 31, found that Zhejiang Fengwo IoT Technology Co., Ltd. has been shipping cheap Android TV boxes preloaded with apps that rewrite the devices' hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones. The operation, named Fuyao, uses the boxes for two distinct jobs depending on whether an HDMI signal is detected.
When HDMI is on, the boxes relay other people's traffic through the owner's broadband line as a SOCKS5 exit node. When HDMI is off, they switch to ad-fraud tasks, clicking ads on websites run by the same operators. Bitsight's sinkhole received 65,957 reports from about 38,000 unique MAC addresses in a single day, though the researchers cautioned that the number is not a confirmed device count because the system can rotate spoofed identifiers. Most identifiable devices reported the model name H96_MAX_V11, though Bitsight said its sinkhole view was skewed toward older models from one brand and did not establish a complete affected-model list.
Fuyao's operators assemble campaign logic in a custom editor built on Google's Blockly framework, export each fraud routine as JavaScript, upload it to an S3 bucket, and push it to the boxes for execution. Bitsight mapped 144 operator-owned domains across seven beneficiary clusters, with at least 84 loading a Taboola tag. The researchers estimated gross returns at $1.25 per device per day, or roughly $47,500 daily if the 38,000-device estimate holds, though the company noted those are modeled figures, not observed revenue. The command-and-control server pushes complete phone profiles to each device, merging a base configuration with a per-model diff and deleting chipset properties that would expose a Rockchip, Amlogic, or Allwinner board underneath. Fuyao uses machine vision inside its automation workflow to locate ads. The Script app carries a YOLOv8s object-detection model named lourui_2, trained on 12 screen elements, including generic banner regions and Taboola widgets. Pedro Falé, a Bitsight threat researcher, wrote that the operation "fuses three vision and reasoning systems into a single interface."
What IoT Users Should Do Now
Both findings underscore a broader pattern: the same devices that make homes smarter also expand the attack surface. For Home Assistant users, upgrading to version 2026.6.2 is the immediate priority. The patch is straightforward, but the underlying lesson is that even widely trusted open-source components like FFmpeg can become high-impact vulnerabilities when integrated without thorough input validation. The elttam advisory notes that ordering of FFmpeg arguments matters critically — the allowlist must appear before the -i input argument, or FFmpeg will ignore it. The researchers also recommend that developers sanitize all user-controlled parameters passed into system utilities, not just those that appear dangerous at first glance.
For owners of cheap Android TV boxes, the guidance is less reassuring. Bitsight recommends verifying Play Protect certification and disconnecting suspicious devices from the network, but the Fuyao apps are designed to hide their true nature, making detection difficult. The operation's use of machine vision, including a YOLOv8s model for ad placement, shows how IoT devices can be weaponized into a distributed infrastructure with minimal technical skill. For owners, guidance remains generic: verify Play Protect certification and disconnect suspicious devices from the network. The researchers also advise monitoring outbound connections for unexpected SOCKS5 traffic, which would indicate a compromised box acting as a proxy node.
The Home Assistant community has long championed local control as a privacy advantage, but these disclosures show that local does not automatically mean secure. As smart home ecosystems grow more interconnected, the "glue" components — media processors, voice assistants, network bridges — deserve the same security scrutiny as the cloud services they are meant to replace. The attack surface spans not just the core platform but every integration that passes user-controlled data to system utilities. Elttam's work on Home Assistant's pre-auth attack surface in 2023, which uncovered CVE-2023-27482, established that even components considered low-risk can become critical under the right chain of conditions.
According to elttam, the research was motivated by a simple question: how many high-impact attack chain primitives are sitting unexploitable without a full chain? The answer, it turns out, is more than most users would expect. The Fuyao operation demonstrates the same principle at scale: commodity hardware, repurposed through software supply-chain manipulation, becomes infrastructure for fraud and proxy abuse.
Read the full elttam advisory at elttam.com and the Bitsight Fuyao report at bitsight.com.