CVE-2018-9070
Medium
Description
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.
SeverityMedium
CVSS6.4
Exploit probability—
ProductLenovo Smart Assistant
PublishedJul 13, 2018
First seenJul 13, 2018
How to fix
Update
- lenovo smart_assistant12.1.82 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo smart_assistant | v < 12.1.82 | 12.1.82 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.