A root vulnerability and a few stickers were all it took.