Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-384.
Summary
Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amazon:echo_show_firmware:*:*:*:*:*:*:*:* | before 2018-04-27 | Vulnerable | AWS |
| cpe:2.3:h:amazon:echo_show:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
| cpe:2.3:o:amazon:echo_plus_firmware:*:*:*:*:*:*:*:* | before 2018-04-27 | Vulnerable | AWS |
| cpe:2.3:h:amazon:echo_plus:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
| cpe:2.3:o:amazon:echo_dot_firmware:*:*:*:*:*:*:*:* | before 2018-04-27 | Vulnerable | AWS |
| cpe:2.3:h:amazon:echo_dot:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
| cpe:2.3:o:amazon:echo_spot_firmware:*:*:*:*:*:*:*:* | before 2018-04-27 | Vulnerable | AWS |
| cpe:2.3:h:amazon:echo_spot:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
| cpe:2.3:o:amazon:echo_firmware:*:*:*:*:*:*:*:* | before 2018-04-27 | Vulnerable | AWS |
| cpe:2.3:h:amazon:echo:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AWS |
- cpe:2.3:o:amazon:echo_show_firmware:*:*:*:*:*:*:*:* Versions before 2018-04-27 Vulnerable ·AWS
- cpe:2.3:h:amazon:echo_show:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
- cpe:2.3:o:amazon:echo_plus_firmware:*:*:*:*:*:*:*:* Versions before 2018-04-27 Vulnerable ·AWS
- cpe:2.3:h:amazon:echo_plus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
- cpe:2.3:o:amazon:echo_dot_firmware:*:*:*:*:*:*:*:* Versions before 2018-04-27 Vulnerable ·AWS
- cpe:2.3:h:amazon:echo_dot:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
- cpe:2.3:o:amazon:echo_spot_firmware:*:*:*:*:*:*:*:* Versions before 2018-04-27 Vulnerable ·AWS
- cpe:2.3:h:amazon:echo_spot:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
- cpe:2.3:o:amazon:echo_firmware:*:*:*:*:*:*:*:* Versions before 2018-04-27 Vulnerable ·AWS
- cpe:2.3:h:amazon:echo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AWS
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11567
- 2026-10-03 Alias added: GHSA-vjfx-9v82-g36p
References
More AWS Echo Dot Firmware vulnerabilities
- TI-2022-09379 Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot… CVSS 3.1CRITICAL 9.8
- TI-2021-15368 Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical… CVSS 3.1MEDIUM 4.2
Sources
- CVE-2018-11567 · CVE Program
- CVE-2018-11567 · NVD
- FIRST EPSS
- GHSA-vjfx-9v82-g36p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences