My TV (Finlux) has an undocumented API, that allows anyone to pull information about what I'm watching at the moment. That same API can be used to launch a telnet daemon which can then be used to log in as root without using a password. Needless to say I've disabled wifi on it and I don't intend to ever connect it again.

But hey, the TV runs Linux, which is nice I guess.