CVE-2023-48419CWE-269

An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP

Critical · published January 2, 2024

CVSS v3.1
10.0
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

🚨 An attacker only needs to be close to your Google Home, and they can start monitoring you — it's like someone eavesdropping on your conversations from the next room! 🔥 Imagine you're at a coffee shop, and there's someone sitting at the next table, not just listening to your conversation, but recording everything. With this vulnerability, an attacker can do just that, but with your Google Home! An attacker can elevate their privileges and spy on you, allowing them to hear your private conversations or gather sensitive information without your knowledge. This invasion of privacy is absolutely devastating and could lead to serious breaches of your personal security.

Put simply

Imagine you're at a coffee shop, and there's someone sitting at the next table, not just listening to your conversation, but recording everything. With this vulnerability, an attacker can do just that, but with your Google Home! CVE-2023-48419 allows attackers within Wi-Fi range of a target Google Home device to elevate their privileges, enabling them to intercept and potentially record conversations through the smart speaker.

What to do

An attacker can elevate their privileges and spy on you, allowing them to hear your private conversations or gather sensitive information without your knowledge. This invasion of privacy is absolutely devastating and could lead to serious breaches of your personal security. To protect yourself, ensure your Google Home is updated to the latest firmware version immediately. Additionally, consider adjusting your Wi-Fi security settings to limit access to trusted devices only. Regularly audit your connected devices to ensure no unauthorized access is occurring. You've got this! With a few quick steps, you can safeguard your privacy and keep your conversations secure. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-01-02T18:44Z
EPSS history
Timeline
  • 02 JAN 18:44Z
    An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP
    cvelistv5