[syn0byte]

There is no RPi vulnerability(in this article). The RPi was just used as a bastion into the internal network. It could have been any SBC. Once your already inside the internal network things get stupid lax.

EG. I can't see your Windows shared folders from the internet, but the PC in the next room can. Someone sneaked an RPi into JPL to be that PC in the next room.

See Also; Season 1 Mr Robot had this exact scenario as a plot point.

[jvanderbot]

No, they infiltrated a Rpi already on the network (e.g. a research SBC) which itself was also able to access other machines.

[giancarlostoro]

I was thinking Mr. Robot the whole time.