Amazon Echo Dot Firmware vulnerabilities

3 CVEs affecting Amazon Echo Dot Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25809, published 2022-02-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-25809, published 2022-02-24. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a malicious skill (in the case of remote…
CVE-2018-11567, published 2018-05-30. Low severity, CVSS 3.3. EPSS: 1.1% chance of exploitation in the next 30 days. Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8…
CVE-2021-37436, published 2021-07-24. Medium severity, CVSS 4.2. EPSS: 0.3% chance of exploitation in the next 30 days. Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and…