CVE-2022-25809

CVE-2022-25809 affects Amazon Echo Dot devices (3rd and 4th Gen). Root cause: improper neutralization of audio output enables arbitrary voice command execution via a malicious skill (remote) or by pairing a malicious Bluetooth device (physical proximity) in an Alexa-versus-Alexa (AvA) scenario. I...

CVE-2021-37436

CVE-2021-37436 affects Amazon Echo Dot devices. The connected sources describe a design/logic flaw that, after a factory reset, can let an attacker with physical access extract sensitive information through a sequence of hardware and software attacks. There are no published patch details in the p...

CVE-2018-11567

The CVE concerns Amazon Echo devices where the reprompt feature can be misused by a malicious Alexa skill. Affected component: reprompt handling within Echo devices (prior to 2018-04-27). Root cause: empty output-speech reprompts, wildcard input slots, and logging of detected speech enable an att...