VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Jul 13, 2018· Updated Jun 17, 2026

CVE-2018-9070

CVE-2018-9070

Description

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.

Affected products

3
  • Lenovo/Smart Assistant3 versions
    cpe:2.3:a:lenovo:smart_assistant:*:*:*:*:*:android:*:*+ 2 more
    • cpe:2.3:a:lenovo:smart_assistant:*:*:*:*:*:android:*:*range: <12.1.82
    • (no CPE)range: <12.1.82
    • (no CPE)range: Earlier than 12.1.82

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.