Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Mycroft Core allows remote code execution via Websocket

CVE-2018-1000621 · published 8 years ago
Summary

The Mycroft core software for Linux installations can be accessed over an open Websocket connection, letting an attacker run code on the server. This risk does not affect the Mark 1 or Picroft versions. Until a fix is released, limit network access to the service with a firewall or disconnect it from the internet.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mycroft mycroft-core <= 18.2.8b
cpe:2.3:a:mycroft:mycroft-core:*:*:*:*:*:*:*:*
Original advisory text
Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for...
Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and "non-enclosure" installs - Mark 1 and Picroft unaffected. This attack appear to be exploitable remote access to the unsecured websocket server. This vulnerability appears to have been fixed in No fix currently available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Exploitation
3% chance of attack within 30 days
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published9 Jul 2018
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-1000621 · NVD
Track software like this
Free during beta