CVE-2022-25809 - CVE House
Back to Database
Status published Critical CVE-2022-25809

Improper Neutralization of audio output from 3rd and 4th Generation...

Vulnerability Description

Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on these devices via a malicious skill (in the case of remote attackers) or by pairing a malicious Bluetooth device (in the case of physically proximate attackers), aka an "Alexa versus Alexa (AvA)" attack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25809

Credits & Attribution

No credits recorded in the NVD database.

References

More from amazon

View All →
CVE-2024-52314
data.all admin user may access potentially sensitive data stored by producers via logs
Medium 6.9
CVE-2024-52313
data.all authenticated users can obtain incorrect object level authorizations
Medium 5.3
CVE-2024-52312
data.all authenticated users can perform restricted operations against DataSets and Environments
Medium 5.3
CVE-2024-52311
data.all does not invalidate authentication token upon user logout
Medium 5.3
CVE-2024-10953
data.all authenticated users can perform mutating update operations on persisted notification records
Medium 5.3

Affected Vendor

Affected Software

echo dot firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: February 23rd, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.