CVE-2018-9070: For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a spe...

Description

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.

Metrics

EPSS Probability

0.29%

20.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Lenovo	Smart Assistant	< 12.1.82

References

https://support.lenovo.com/us/en/solutions/LEN-22172Mitigation, Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-22172Mitigation, Vendor Advisory

Timeline

Published: Jul 13, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-9070?

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.

How severe is CVE-2018-9070?

Severity scoring for CVE-2018-9070 is pending analysis. The EPSS model estimates a 0.29% probability of exploitation in the next 30 days.

How do I fix CVE-2018-9070?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →