Audio Signal Command Injection in Amazon Echo Devices

CVE-2023-33248

What is CVE-2023-33248?

The Amazon Alexa software in Echo Dot 2nd and 3rd generation devices is vulnerable to a sophisticated form of command injection that exploits audio signals within the 16 to 22 kHz frequency range. This range often goes unheard by the average human, allowing attackers to issue security-relevant commands that typically would not be communicated by legitimate users. Due to the nature of these commands and the lack of audible detection, a significant portion of these attacks can succeed without detection, posing a serious security risk to users reliant on these smart devices.

References