CVE-2021-37436

Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing personal content via a factory reset. Also, the vendor has reportedly indicated that they are working on mitigations.

• https://arstechnica.com/gadgets/2021/07/passwords-in-amazon-echo-dots-live-on-even-after-you-factory-reset-them/Third Party Advisory
• https://dl.acm.org/doi/pdf/10.1145/3448300.3467820Technical Description, Third Party Advisory
• https://news.ycombinator.com/item?id=27943730Third Party Advisory
• https://www.cpomagazine.com/data-privacy/is-it-possible-to-make-iot-devices-private-amazon-echo-dot-does-not-wipe-personal-content-after-factory-reset/Third Party Advisory
• https://arstechnica.com/gadgets/2021/07/passwords-in-amazon-echo-dots-live-on-even-after-you-factory-reset-them/Third Party Advisory
• https://dl.acm.org/doi/pdf/10.1145/3448300.3467820Technical Description, Third Party Advisory
• https://news.ycombinator.com/item?id=27943730Third Party Advisory
• https://www.cpomagazine.com/data-privacy/is-it-possible-to-make-iot-devices-private-amazon-echo-dot-does-not-wipe-personal-content-after-factory-reset/Third Party Advisory

Published

Jul 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37421Zoho ManageEngine ADSelfService Plus 6103 and prior is vulne…9.8
• CVE-2021-37422Zoho ManageEngine ADSelfService Plus 6111 and prior is vulne…9.8
• CVE-2021-37423Zoho ManageEngine ADSelfService Plus 6111 and prior is vulne…9.8
• CVE-2021-37424ManageEngine ADSelfService Plus before 6112 is vulnerable to…9.8
• CVE-2021-37425Altova MobileTogether Server before 7.3 SP1 allows XXE attac…9.1
• CVE-2021-3743An out-of-bounds (OOB) memory read flaw was found in the Qua…7.1
• CVE-2021-37438Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-37439NCH FlexiServer v6.00 suffers from a syslog?file=/.. path tr…6.5
• CVE-2021-3744A memory leak flaw was found in the Linux kernel in the ccp_…5.5
• CVE-2021-37440NCH Axon PBX v2.22 and earlier allows path traversal for fil…6.5
• CVE-2021-37441NCH Axon PBX v2.22 and earlier allows path traversal for fil…8.8
• CVE-2021-37442NCH IVM Attendant v5.12 and earlier allows path traversal vi…6.5