PT-2026-22937 · Mobvoi · Mobvoi Tichome Mini

Published 2026-03-04 · Updated 2026-03-04 · CVE-2026-26478

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mobvoi Tichome Mini smart speaker versions 012-18853 and 027-58389

Description A shell command injection flaw exists in the Mobvoi Tichome Mini smart speaker. Remote attackers can send a crafted UDP datagram to execute arbitrary shell code as the root account.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26478

Affected Products

Mobvoi Tichome Mini

References · 8

• 🔥 https://github.com/pastcompute/tichome-poc-1 · Exploit
• https://osv.dev/vulnerability/CVE-2026-26478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26478 · Security Note
• https://twitter.com/CVEnew/status/2029272859613241843 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029246762527904228 · Twitter Post
• https://web.archive.org/web/20171202094530 · Note
• https://twitter.com/TheHackerWire/status/2029248118286692826 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029273581520122105 · Twitter Post