Guan-Wei Hou

An issue was discovered in XIAOMI XIAOAI speaker Pro LX06, where attackers can activate the failsafe mode during the boot process and use the `mi console` command cascaded by the `SN` code to get the root shell password. This allows the attacker to read Wi-Fi SSID or password, read dialogue text files between users and the device, use Text-To-Speech tools to pretend the device's voice for social engineering attacks, eavesdrop on users and record what the device hears, modify system files, send IR codes through the IR emitter, stop the voice assistant service, enable SSH or TELNET service as a backdoor, and tamper with the router configuration in local area networks.

An issue was discovered that allows attackers to gain root shell access by accessing the UART interface. This access enables various malicious activities, including: - reading Wi-Fi SSID or password, - reading dialogue text files between users and the device, - using Text-To-Speech tools to pretend to be the device's voice for social engineering attacks, - eavesdropping on users and recording what the device hears, - modifying system files, - sending any IR code through the IR emitter, - stopping the voice assistant service, - enabling the device's SSH or TELNET service as a backdoor, - tampering with the router configuration in local area networks.