What’s Vulnerable › Vulnerabilities

CVE-2018-20007

• Severity: medium (CVSS 6.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-16 · updated 2026-06-17
• Weakness: CWE-732

Description

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.

Affected products

• Yeelight Smart Ai Speaker Firmware: 3.3.10_0074

References

• https://forum.yeelight.com/
• https://payatu.com/yeelight-smart-ai-speaker-responsible-disclosure/
• https://forum.yeelight.com/
• https://payatu.com/yeelight-smart-ai-speaker-responsible-disclosure/

Get alerted when CVE-2018-20007 or the next vulnerability affects your stack