CVE-2026-26478
Shell Command Injection in Mobvoi Tichome Mini Enables Root RCE
Publication date: 2026-03-04
Last updated on: 2026-03-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mobvoi | tichome_mini_firmware | 012-18853 |
| mobvoi | tichome_mini_firmware | 027-58389 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-26478 is a shell command injection vulnerability in the Mobvoi Tichome Mini smart speaker models 012-18853 and 027-58389. It allows remote attackers to send a specially crafted UDP datagram to the device's exposed IPC daemon on UDP port 35670, which processes the data unsafely using the C system() function. This leads to execution of arbitrary shell commands with root privileges."}, {'type': 'paragraph', 'content': 'The vulnerability arises because the device executes shell commands based on a 128-byte string received in the UDP packet without proper validation, enabling attackers to run commands such as spawning reverse shells, pinging back to the attacker, or crashing the device.'}, {'type': 'paragraph', 'content': 'Exploitation requires network proximity since the UDP port is only exposed on the local subnet. Attackers can gain persistent root access by uploading scripts, remounting the system partition as writable, and installing an SSH daemon.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can have severe impacts including unauthorized remote root access to the device, allowing attackers to execute arbitrary commands with full privileges.'}, {'type': 'list_item', 'content': "Covert surveillance through unauthorized audio recording or playback using the device's microphone and speaker."}, {'type': 'list_item', 'content': 'Pivoting for lateral movement within the local network, potentially compromising other devices.'}, {'type': 'list_item', 'content': "Use of the device as a WiFi relay or 'pineapple' by reconfiguring it as both WiFi access point and client."}, {'type': 'list_item', 'content': 'Participation in botnets or distributed denial-of-service (DDoS) attacks.'}, {'type': 'list_item', 'content': 'Denial of service (DoS) caused by crashing the IPC process through malformed packets.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for UDP packets sent to port 35670, which is used by the vulnerable IPC daemon on the Mobvoi Tichome Mini smart speaker.
Specifically, detection involves identifying specially crafted UDP datagrams with message type 0x13 and payloads that may trigger the command injection.
You can use network packet capture tools such as tcpdump or Wireshark to filter and analyze UDP traffic on port 35670.
- tcpdump -i <interface> udp port 35670
- wireshark filter: udp.port == 35670
Additionally, proof-of-concept scripts exist that send commands like ping or reverse shells to the device, which can be used in controlled environments to verify if a device is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include isolating the vulnerable Mobvoi Tichome Mini devices from untrusted networks to prevent attackers from sending malicious UDP packets.
Since the vulnerability requires network proximity (same IP subnet) due to the UDP port exposure, restricting network access to the device or disabling UDP port 35670 at network boundaries can reduce risk.
Because the vendor has confirmed the device is end-of-life with no planned fixes, consider removing or replacing the affected devices if possible.
Monitoring for unusual network activity such as unexpected UDP traffic or device behavior (e.g., unexpected WiFi access point configurations or audio activity) can help detect exploitation attempts.