CVE-2018-20007

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell

published May 16, 2019

CVSS
—
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00487 · 40.7th percentile
Published
2019-05-16T18:08Z
EPSS history
Timeline
  • 16 MAY 18:08Z
    Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell
    cvelistv5