CVE-2018-20007

MEDIUM

Yeelight Smart AI Speaker 3.3.10_0074 - Privilege Escalation

Title source: llm

Description

Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

https://forum.yeelight.com/

Exploit, Third Party Advisory x_refsource_misc

https://payatu.com/yeelight-smart-ai-speaker-responsible-disclosure/

Scores

CVSS v3 6.8

EPSS 0.0004

EPSS Percentile 12.5%

Attack Vector PHYSICAL

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-732

Status published

Products (1)

yeelight/smart_ai_speaker_firmware 3.3.10_0074

Published May 16, 2019

Tracked Since Feb 18, 2026