PT-2021-21650 · Amazon · Amazon Echo Dot

Published 2021-07-24 · Updated 2021-08-09 · CVE-2021-37436

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Amazon Echo Dot devices through 2021-07-02

Description The issue allows attackers with physical access to a device after a factory reset to obtain sensitive information via complex hardware and software attacks. It is noted that vendor marketing statements claimed that a factory reset would safely remove personal content. The vendor is reportedly working on mitigations.

Recommendations For Amazon Echo Dot devices through 2021-07-02, as a temporary workaround, consider taking extra precautions when disposing of or resetting devices to minimize the risk of sensitive information being obtained by unauthorized parties. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2021-37436

Affected Products

Amazon Echo Dot

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-37436 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37436 · Vendor Advisory
• https://arstechnica.com/gadgets/2021/07/passwords-in-amazon-echo-dots-live-on-even-after-you-factory-reset-them · Note
• https://dl.acm.org/doi/pdf/10.1145/3448300.3467820 · Note
• https://news.ycombinator.com/item?id=27943730 · Note
• https://t.me/cvenotify/18078 · Telegram Post
• https://t.me/cibsecurity/26453 · Telegram Post
• https://cpomagazine.com/data-privacy/is-it-possible-to-make-iot-devices-private-amazon-echo-dot-does-not-wipe-personal-content-after-factory-reset · Note