{"id":"CVE-2018-1000621","details":"Mycroft AI mycroft-core version 18.2.8b and earlier contains a Incorrect Access Control vulnerability in Websocket configuration that can result in code execution. This impacts ONLY the Mycroft for Linux and \"non-enclosure\" installs - Mark 1 and Picroft unaffected. This attack appear to be exploitable remote access to the unsecured websocket server. This vulnerability appears to have been fixed in No fix currently available.","modified":"2026-04-10T04:05:44.267968Z","published":"2018-07-09T20:29:00.783Z","references":[{"type":"ADVISORY","url":"https://community.mycroft.ai/t/zero-click-remote-code-execution-in-mycroft-ai-vocal-assistant/3930/13"},{"type":"EVIDENCE","url":"https://github.com/Nhoya/MycroftAI-RCE"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mycroftai/mycroft-core","events":[{"introduced":"0"},{"last_affected":"cdd5800098c33226e56c4d14dcfd732d25b07a63"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"18.2.8b"}]}}],"versions":["release/0.7.10","release/0.7.11","release/0.7.12","release/0.7.13","release/0.7.14","release/0.7.15","release/0.7.16","release/0.7.17","release/0.7.18","release/0.7.19","release/0.7.20","release/0.7.8","release/0.7.9","release/0.8.4","release/v0.6.0","release/v0.6.1","release/v0.6.2","release/v0.6.3","release/v0.6.9","release/v0.7.0","release/v0.7.1","release/v0.7.2","release/v0.7.3","release/v0.7.4","release/v0.7.5","release/v0.7.6","release/v0.7.7","release/v0.8.0","release/v0.8.1","release/v0.8.14","release/v0.8.15","release/v0.8.16","release/v0.8.17","release/v0.8.18","release/v0.8.19","release/v0.8.2","release/v0.8.20","release/v0.8.21","release/v0.8.22","release/v0.8.3","release/v0.8.4","release/v0.8.5","release/v0.9.0","release/v0.9.1","release/v0.9.10","release/v0.9.11","release/v0.9.12","release/v0.9.13","release/v0.9.14","release/v0.9.15","release/v0.9.16","release/v0.9.17","release/v0.9.18","release/v0.9.19","release/v0.9.2","release/v0.9.4","release/v0.9.5","release/v0.9.6","release/v0.9.7","release/v0.9.8","release/v0.9.9","release/v18.2.0","release/v18.2.1","release/v18.2.2","release/v18.2.3","release/v18.2.4","release/v18.2.5","release/v18.2.6","release/v18.2.7","release/v18.2.8","v0.8.2","v0.8.3","v0.8.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000621.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}