Admittedly below our already not high expectations for a WiFi accessible space heater:
An unverified OTA update process in a Govee smart space heater—using HTTP with weak integrity checks (a simple checksum and HMAC with a hardcoded key)—allows MITM attackers to inject modified firmware, enabling arbitrary control or bricking. Exposed debug interfaces with weak credentials compound the vulnerability.
https://blog.includesecurity.com/2025/02/replacing-a-space-heater-firmware-over-wifi/