Behind a cheap Temu doorbell sits an IoT backend where device IDs are sequential and requests are forgeable with a string baked into every firmware. One signed call lifts any device’s persistent password and lets anyone on the Internet hijack the next live call.