CVE-2024-41624

MediumCVSS 6.3

Published: 29/07/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

An incorrect access control vulnerability in the Himalaya Xiaoya nano smart speaker (rom_version 1.6.96) allows a remote attacker to have an unspecified impact. The flaw enables unauthorized access to the device.

Risk Assessment

The organization faces the risk of remote compromise of the smart speaker, potentially leading to eavesdropping, privacy breaches, or using the device as an entry point into the local network.

Recommendation

Immediately update the speaker's firmware to the latest version if a patch is available. If not, restrict external network access to the device.

Original NVD description (English source)

Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact.