UPDATE: LeapFrog rejects some of the assertions in Carthy's blog post, specifically regarding the usage of Flash on the LeapPad Ultra. Granted, it’s questionable how much damage a hacker could (or would want to) do with a tablet for small children, but chances are, someone’s willing to try. If you buy a LeapPad Ultra, be sure to install the Connect companion software as soon as possible and keep the device up to date - although that will only mitigate its security problems, not solve them entirely. “You’d never live something like that down – ever.” “Can you imagine being DDoS’d by a LeapFrog botnet?” McCarthy wrote. This code could do anything from hijacking the device to drafting it into a botnet. If you hand off a LeapPad Ultra to a child before installing LeapPad Connect on your own machine, a hacker could compromise it quite easily with a remote code execution via the Flash flaw. However, updating Flash is not necessary to watch Flash videos. To be fair, if you set up the device as recommended and install the LeapFrog Connect companion application on your computer, it will update Flash to the current, vulnerability-free version once the LeapPad is connected to a PC or Mac.

The LeapPad Ultra does not automatically update Flash Player, or prompt the user to install an update.

My own leaptop hack