CVE-2023-33248 - Vulnerability Details - OpenCVE

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Amazon	Alexa Echo Dot

Configuration 1 [-]

AND

cpe:2.3:o:amazon:alexa:8960323972:*:*:*:*:*:*:*

OR	cpe:2.3:h:amazon:echo_dot:-::2nd_gen:::::
	cpe:2.3:h:amazon:echo_dot:-::3rd_gen:::::

No data.

References

Link	Providers
https://arxiv.org/abs/2305.10358
https://cios2023.org/papers
https://github.com/reveondivad/nuance
https://sites.google.com/view/nuitattack/home
https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf
https://youtu.be/3gEc5ZFWIWo

History

Thu, 16 Jan 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-05-24T00:00:00

Updated: 2025-01-16T16:04:36.579Z

Reserved: 2023-05-21T00:00:00

Link: CVE-2023-33248

Vulnrichment

Updated: 2024-08-02T15:39:36.038Z

NVD

Status : Modified

Published: 2023-05-24T22:15:09.207

Modified: 2025-01-16T16:15:29.630

Link: CVE-2023-33248

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-33248", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-01-16T16:04:36.579Z", "dateReserved": "2023-05-21T00:00:00", "datePublished": "2023-05-24T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-05-24T00:00:00"}, "descriptions": [{"lang": "en", "value": "Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://cios2023.org/papers"}, {"url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf"}, {"url": "https://sites.google.com/view/nuitattack/home"}, {"url": "https://arxiv.org/abs/2305.10358"}, {"url": "https://github.com/reveondivad/nuance"}, {"url": "https://youtu.be/3gEc5ZFWIWo"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:36.038Z"}, "title": "CVE Program Container", "references": [{"url": "https://cios2023.org/papers", "tags": ["x_transferred"]}, {"url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf", "tags": ["x_transferred"]}, {"url": "https://sites.google.com/view/nuitattack/home", "tags": ["x_transferred"]}, {"url": "https://arxiv.org/abs/2305.10358", "tags": ["x_transferred"]}, {"url": "https://github.com/reveondivad/nuance", "tags": ["x_transferred"]}, {"url": "https://youtu.be/3gEc5ZFWIWo", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T16:04:32.058774Z", "id": "CVE-2023-33248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T16:04:36.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cios2023.org/papers", "tags": ["x_transferred"]}, {"url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf", "tags": ["x_transferred"]}, {"url": "https://sites.google.com/view/nuitattack/home", "tags": ["x_transferred"]}, {"url": "https://arxiv.org/abs/2305.10358", "tags": ["x_transferred"]}, {"url": "https://github.com/reveondivad/nuance", "tags": ["x_transferred"]}, {"url": "https://youtu.be/3gEc5ZFWIWo", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:36.038Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-33248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T16:04:32.058774Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T15:59:57.706Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://cios2023.org/papers"}, {"url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf"}, {"url": "https://sites.google.com/view/nuitattack/home"}, {"url": "https://arxiv.org/abs/2305.10358"}, {"url": "https://github.com/reveondivad/nuance"}, {"url": "https://youtu.be/3gEc5ZFWIWo"}], "descriptions": [{"lang": "en", "value": "Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-05-24T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2023-33248", "state": "PUBLISHED", "dateUpdated": "2025-01-16T16:04:36.579Z", "dateReserved": "2023-05-21T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-05-24T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:amazon:alexa:8960323972:*:*:*:*:*:*:*", "matchCriteriaId": "8A43F757-D8D2-450E-9454-6AEB1E417E34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:amazon:echo_dot:-:*:2nd_gen:*:*:*:*:*", "matchCriteriaId": "23FBCB3B-2917-4AFC-8C67-976C2EDFAC68", "vulnerable": false}, {"criteria": "cpe:2.3:h:amazon:echo_dot:-:*:3rd_gen:*:*:*:*:*", "matchCriteriaId": "F6999715-5BAE-48C6-A5C9-E00B89AE7104", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful."}], "id": "CVE-2023-33248", "lastModified": "2025-01-16T16:15:29.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-05-24T22:15:09.207", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://arxiv.org/abs/2305.10358"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://cios2023.org/papers"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/reveondivad/nuance"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://sites.google.com/view/nuitattack/home"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://youtu.be/3gEc5ZFWIWo"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://arxiv.org/abs/2305.10358"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cios2023.org/papers"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/reveondivad/nuance"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://sites.google.com/view/nuitattack/home"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://youtu.be/3gEc5ZFWIWo"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}