What’s Vulnerable › Vulnerabilities

CVE-2023-48419: An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-02 · updated 2026-06-17
• Weakness: CWE-269

Description

An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege

Affected products

• Google Home Firmware: before 2.58 — fixed in 2.58
• Google Home Mini Firmware: before 2.58 — fixed in 2.58
• Google Nest Audio Firmware: before 2.58 — fixed in 2.58
• Google Nest Mini Firmware: before 2.58 — fixed in 2.58

How to fix

Upgrade to a fixed version: Google Home Firmware 2.58; Google Home Mini Firmware 2.58; Google Nest Audio Firmware 2.58; Google Nest Mini Firmware 2.58. Check the vendor advisory for mitigations.

References

• https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=4533873659772963473-NA#zippy=%2Cspeakers
• https://support.google.com/product-documentation/answer/14273332?hl=en&ref_topic=12974021&sjid=4533873659772963473-NA#zippy=%2Cspeakers

Get alerted when CVE-2023-48419 or the next vulnerability affects your stack