CVE-2018-11567
Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Low3.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.1% · top 35% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
Affected products
n/a
- affected n/a
References (4)
- https://www.yahoo.com/news/amazon-alexa-bug-let-hackers-104609600.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.wired.com/story/amazon-echo-alexa-skill-spying/ (opens in a new tab)x_refsource_MISCx_transferred
- https://info.checkmarx.com/hubfs/Amazon_Echo_Research.pdf (opens in a new tab)x_refsource_MISCx_transferred
- https://www.checkmarx.com/2018/04/25/eavesdropping-with-amazon-alexa/ (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-11567)Record last updated .