CVE-2018-20007 in Smart AI Speaker

Résumé

par MITRE

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.

Be aware that VulDB is the high quality source for vulnerability data.

• Réserver: 10/12/2018
• Modérer: accepté
• Entrée: VDB-135148
• CPE: prêt
• CWE: CWE-284 (confirmé)
• CVSS: 6.8 (NVD)
• EPSS: 0.00042
• KEV: non
• Activités: très faible
• Secteur: Insurance, Telecommunication, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2018-20007
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-20007
• CVE Details: https://www.cvedetails.com/cve/CVE-2018-20007/