CVE-2018-11567
Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is…
- 3.3LowCVSS base score
- 1.0%Exploitation in 30 daysEPSS · top 35% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa does not receive an input within 8 seconds, the device can speak a reprompt, then wait an additional 8 seconds for input; if the user still does not respond, the microphone is then turned off. The vulnerability involves empty output-speech reprompts, custom wildcard ("gibberish") input slots, and logging of detected speech. If a maliciously designed skill is installed, an attacker could obtain transcripts of speech not intended for Alexa to process, but simply spoken within the device's hearing range. NOTE: The vendor states "Customer trust is important to us and we take security and privacy seriously. We have put mitigations in place for detecting this type of skill behavior and reject or suppress those skills when we do. Customers do not need to take any action for these mitigations to work.
Timeline
ID reserved
By mitre
Published
- 6 years later
· 6 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Low3.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 1.0% · top 35% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Affected products
n/a
- affected n/a
References
4
- https://www.yahoo.com/news/amazon-alexa-bug-let-hackers-104609600.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.wired.com/story/amazon-echo-alexa-skill-spying/ (opens in a new tab)x_refsource_MISCx_transferred
- https://info.checkmarx.com/hubfs/Amazon_Echo_Research.pdf (opens in a new tab)x_refsource_MISCx_transferred
- https://www.checkmarx.com/2018/04/25/eavesdropping-with-amazon-alexa/ (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2018-3593 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2018-11567)Record last updated .