Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

CogniToys Dino toys allow replay of voice traffic

CVE-2017-8865 · published 8 years ago
Summary

The Dino smart toys (firmware up to version 0.0.794) do not properly protect the voice data they send to the cloud. An attacker on the same network could capture that data and play it back to another Dino, potentially causing unwanted conversations. Update the firmware to a newer version as soon as it is available or restrict network access to the toys.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cognitoys stemosaur_firmware <= 0.0.794
cpe:2.3:o:cognitoys:stemosaur_firmware:*:*:*:*:*:*:*:*
Original advisory text
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP ...
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an attacker on the network to replay VoIP traffic between a Dino device and remote server to any other Dino device.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published11 Dec 2017
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-8865 · NVD
Track software like this
Free during beta