CVE-2022-25809

2022-02-2302:19:52

mitre

www.cve.org

cve-2022-25809

alexa versus alexa

voice command execution

remote attackers

bluetooth device

AI Score

9.8

Confidence

High

EPSS

0.006

Percentile

78.8%

JSON

Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a malicious skill (in the case of remote attackers) or by pairing a malicious Bluetooth device (in the case of physically proximate attackers), aka an “Alexa versus Alexa (AvA)” attack.

References

arxiv.org/abs/2202.08619