I've found description of vulnerability here.
The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP. An attacker on the local network can use the same key to encrypt and send unsolicited commands to the device and hijack it.
Then how it should be done in a secure way, I mean how to encrypt communication without hard coding key in client?