CVE-2018-11567

CVE-2018-11567 describes a privacy vulnerability in Amazon Echo devices prior to April 27, 2018, affecting various Echo models and their firmware. A malicious Alexa skill could exploit the reprompt feature, combined with empty output-speech and custom wildcard input slots, to surreptitiously record and obtain transcripts of speech not intended for Alexa. The vulnerability has a low CVSS score of 3.3, indicating a low attack complexity requiring user interaction, with a potential impact of limited confidentiality compromise. There is no evidence of active exploitation, public exploit code, or significant community discussion, and the vendor has implemented mitigations to detect and suppress such malicious skills.