PT-2020-12011 · Xiaomi · Xiaomi Xiaoai Speaker Pro Lx06
Guan-Wei Hou
+3
·
Published
2020-04-08
·
Updated
2021-07-21
·
CVE-2020-10262
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
XIAOMI XIAOAI speaker Pro LX06 version 1.58.10
Description
An issue was discovered in XIAOMI XIAOAI speaker Pro LX06, where attackers can activate the failsafe mode during the boot process and use the
mi console command cascaded by the SN code to get the root shell password. This allows the attacker to read Wi-Fi SSID or password, read dialogue text files between users and the device, use Text-To-Speech tools to pretend the device's voice for social engineering attacks, eavesdrop on users and record what the device hears, modify system files, send IR codes through the IR emitter, stop the voice assistant service, enable SSH or TELNET service as a backdoor, and tamper with the router configuration in local area networks.Recommendations
For XIAOMI XIAOAI speaker Pro LX06 version 1.58.10, as a temporary workaround, consider disabling the
mi console command and restricting access to the device's SN code to minimize the risk of exploitation. Additionally, restrict access to the IR emitter and the voice assistant service until a patch is available. Avoid using the device's Text-To-Speech tools and do not rely on the device's voice for sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Xiaomi Xiaoai Speaker Pro Lx06