What is CVE-2018-9070?

CVE-2018-9070 is a medium-severity vulnerability in Lenovo Smart Assistant. CVSS score: 6.4/10. Published 2018-07-13.

How severe is CVE-2018-9070?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Vulnerability in Lenovo Smart Assistant

CVE-2018-9070

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.

EPSS: 0.003 (20.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Lenovo Smart_assistant
Lenovo Group Ltd. Smart Assistant — versions Earlier than 12.1.82

References

psirt@lenovo.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2018-9070?: CVE-2018-9070 is a medium-severity vulnerability in Lenovo Smart Assistant. CVSS score: 6.4/10. Published 2018-07-13.
How severe is CVE-2018-9070?: Medium severity. CVSS v3 base score is 6.4 out of 10.