{"cve":"CVE-2023-33248","nvd":{"published":"2023-05-24T22:15:09.207","modified":"2026-06-17T06:01:24.547","status":"Modified","description":"Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz (often outside the range of human adult hearing). Commands at these frequencies are essentially never spoken by authorized actors, but a substantial fraction of the commands are successful.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H","score":7.6},"cwes":[],"references":["https://arxiv.org/abs/2305.10358","https://cios2023.org/papers","https://github.com/reveondivad/nuance","https://sites.google.com/view/nuitattack/home","https://www.usenix.org/system/files/sec23fall-prepub-261-xia-qi.pdf"],"products":["amazon:alexa"],"source":"nvd","synced_at":"2026-10-19T21:38:18.424950729+00:00"},"epss":{"cve":"CVE-2023-33248","score":0.00668,"percentile":0.51922,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}