PT-2023-24243 · Amazon · Amazon Alexa

Qi Xia + 2 · Publicado 2023-05-24 · Atualizado 2025-01-16 · CVE-2023-33248

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon Alexa software version 8960323972

Description The issue allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, which is often outside the range of human adult hearing. Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.

Recommendations For Amazon Alexa software version 8960323972, consider disabling the ability to receive commands via audio signals until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the device for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2023-33248

Produtos afetados

Amazon Alexa

Referências · 10

• 🔥 https://github.com/reveondivad/nuance · Exploit
• 🔥 https://youtu.be/3gEc5ZFWIWo · Exploit
• 🔥 https://usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf · Exploit
• https://t.me/cvenotify/107643 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33248 · Nota de Segurança
• https://cios2023.org/papers · Nota
• https://osv.dev/vulnerability/CVE-2023-33248 · Aviso do Fabricante
• https://twitter.com/Mawg0ud/status/1787099407222981064 · Publicação no Twitter
• https://arxiv.org/abs/2305.10358 · Nota
• https://sites.google.com/view/nuitattack/home · Nota