A shell command injection flaw exists in the Mobvoi Tichome Mini smart speaker, allowing an attacker to craft a special UDP datagram that passes unsanitized input to the system shell. The vulnerability can be exploited to execute arbitrary shell commands with root privileges on the device, providing full control over its operating system. The weakness is a classic command injection (CWE‑78).

The flaw affects Mobvoi Tichome Mini appliances that run firmware build 012‑18853 and 027‑58389. Users of these specific firmware releases must verify the build version deployed on their devices to determine exposure.

With a CVSS score of 9.8, the risk of exploitation is very high. The EPSS score of 1% indicates a very low but nonzero probability that the vulnerability will be exploited. Although the vulnerability is not listed in the CISA KEV catalog, its severity and the ability to run commands as root make it a top priority for immediate remediation. Attackers can abuse the local UDP interface without authentication due to the lack of input validation.