CVE-2023-33248 Security feature bypass in n/a
Attackers can bypass voice authentication on Amazon Echo devices by issuing commands via ultrasonic audio signals outside human hearing range.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-33248?
CVE-2023-33248 is a high-severity vulnerability in n/a, published on 24 May 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.
Which versions are affected by CVE-2023-33248?
It affects 1 product.
Products include Amazon Alexa.
How do I fix CVE-2023-33248?
No fix has been published for CVE-2023-33248 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33248 being exploited?
There is no known exploitation of CVE-2023-33248 in the wild and no public exploit code.
Sources
Also known as GHSA-8pwg-75cm-557h.