PT-2018-10673 · Amazon · Alexa+1

Amit Ashbel + 1 · Published 2018-05-30 · Updated 2024-08-05 · CVE-2018-11567

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amazon Echo devices (affected versions not specified)

Description The reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill, allowing an attacker to obtain transcripts of speech not intended for Alexa to process. This issue involves empty output-speech reprompts, custom wildcard input slots, and logging of detected speech. If a maliciously designed skill is installed, it could capture speech spoken within the device's hearing range.

Recommendations For Amazon Echo devices, the vendor has put mitigations in place for detecting this type of skill behavior and rejects or suppresses those skills when detected. Customers do not need to take any action for these mitigations to work.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2018-11567

Affected Products

Alexa

Amazon Echo

References · 6

• 🔥 https://info.checkmarx.com/hubfs/Amazon_Echo_Research.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-11567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11567 · Security Note
• https://yahoo.com/news/amazon-alexa-bug-let-hackers-104609600.html · Note
• https://wired.com/story/amazon-echo-alexa-skill-spying · Note
• https://checkmarx.com/2018/04/25/eavesdropping-with-amazon-alexa · Note