high8.1
CVE-2018-1000621
Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execut…
Impact
Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and "non-enclosure" installs - Mark 1 and Picroft unaffected. This attack appear to be exploitable remote access to the unsecured websocket server. This vulnerability appears to have been fixed in No fix currently available.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mycroft | Mycroft-Core | through 18.2.8b |
Weakness classification
References
- NVD record
- CVE.org record
- https://community.mycroft.ai/t/zero-click-remote-code-execution-in-mycroft-ai-vocal-assistant/3930/13
- https://github.com/Nhoya/MycroftAI-RCE
- https://community.mycroft.ai/t/zero-click-remote-code-execution-in-mycroft-ai-vocal-assistant/3930/13
- https://github.com/Nhoya/MycroftAI-RCE