CVE-2023-48419 is a privilege escalation flaw in the firmware of Google Nest Audio and Nest Mini speakers. The NVD record scores it 10.0 Critical, while Google's own bulletin rates it High. Someone within Wi-Fi range of a device could spy on its owner. Google shipped the fix as an over-the-air update from December 2023.
What's affected
- Google Nest Audio and Nest Mini, matching the firmware and hardware entries in the NVD record.
- Google's Nest Security Bulletin for December 2023 lists CVE-2023-48419 as an elevation of privilege issue with severity High, next to CVE-2023-5129, a remote code execution issue in the same update.
- The bulletin says the listed vulnerabilities have been addressed and that devices started receiving over-the-air updates in December 2023. It does not give us a single fixed firmware number for the speakers that we can quote, so confirm the version through Google's own steps.
- Source conflict: the record says CVSS 10.0 Critical, the Google bulletin says High. Treat both as valid inputs, and note that the bulletin applies Google's own rating scale.
- Severity: the record gives CVSS 10.0, which is critical. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is changed, meaning the impact can reach beyond the vulnerable component.
How to check if you're exposed
There is no package manager involved here. The exposure question is whether each speaker has installed the December 2023 or later firmware.
Google's bulletin has a questions section that explains how to find a Nest device's firmware version, and it says devices download updates automatically over the air. Open the Google Home app, check each Nest Audio and Nest Mini, and compare against the bulletin. Keep a short list of every smart speaker and display in your office or home office, because these devices are rarely tracked in an asset inventory.
If a device has been offline since late 2023, it may never have received the update.
What to do now
- Make sure every Nest Audio and Nest Mini is powered on and connected to the internet so the automatic update can install.
- Find the firmware version using the steps in Google's bulletin and record it.
- Move smart speakers onto a guest or IoT network segment, away from laptops and file shares.
- Use a strong, unique Wi-Fi passphrase and rotate it if it has been shared widely, since the attack needs proximity to the network.
- Remove or replace any unit you cannot update, and add smart speakers to your hardware inventory.
Why it matters
The weakness class is CWE-269 (Improper Privilege Management). In plain terms, a part of the device trusted a caller with more rights than it should have had, and an attacker on the local wireless network could use that to gain access beyond what the owner intended. The record states the outcome as spying on the victim. We have no further technical detail from the sources, and we are not going to guess at it.
Microphones in shared spaces turn a firmware bug into a privacy problem. Consumer devices also tend to sit in offices with no patch tracking, so the practical lesson is simple: know which networked devices you own and let them update.
Quick check
Is CVE-2023-48419 exploited in the wild?
The record's KEV flag is false, and neither the record nor the Google bulletin says it is being exploited. That can change, so check CISA's catalog if you need current status.
Do I need to do anything if auto update is on?
Usually only confirm that the update landed. Devices that were offline for long periods are the ones most likely to be behind.
Sources
Last reviewed: 19 October 2026.
