Google Home (in)Security: An undocumented API in Google home devices is easily exploitable. This command will reboot any on your local network: nmap –open -p 8008 192.168.1.0/24. Jerry Gamblin tweeted what happens when you run that command: “I am not an IOT security expert, but I am pretty sure an unauthenticated curl statement should not be able to reboot the @madebygoogle home hub. pic.com/gCWFm5Ofyb””]
Source: https://jerrygamblin.com/2018/10/29/google-home-insecurity/