Certified Ethical Hacker (CEH) Practice Question

Because the thermostat blindly trusts any firmware image that carries a valid vendor signature and ignores the version field, the attacker's most reliable path is to obtain (or steal) the vendor's private signing key, use it to sign a backdoored firmware, and then deliver that image-either by hosting a rogue update server or intercepting traffic in a man-in-the-middle position. Once flashed, the malicious firmware runs at the lowest level, surviving reboots and factory resets. The other options can grant access, but none guarantee code execution that is both privileged and persistent.