PT-2023-24243 · Amazon · Amazon Alexa

Qi Xia + 2 · Published 2023-05-24 · Updated 2025-01-16 · CVE-2023-33248

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon Alexa software version 8960323972

Description The issue allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz, which is often outside the range of human adult hearing. Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.

Recommendations For Amazon Alexa software version 8960323972, consider disabling the ability to receive commands via audio signals until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the device for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-33248

Affected Products

Amazon Alexa

References · 10

• 🔥 https://github.com/reveondivad/nuance · Exploit
• 🔥 https://youtu.be/3gEc5ZFWIWo · Exploit
• 🔥 https://usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33248 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33248 · Vendor Advisory
• https://t.me/cvenotify/107643 · Telegram Post
• https://cios2023.org/papers · Note
• https://twitter.com/Mawg0ud/status/1787099407222981064 · Twitter Post
• https://arxiv.org/abs/2305.10358 · Note
• https://sites.google.com/view/nuitattack/home · Note