Yandex Station

Yandex Station Root Access Flaw Exploited via Trusted Certificates Error, Patch Now Rolling Out

Enthusiasts discovered a method to obtain root access on their own Yandex Station smart speaker by exploiting an error in the trusted certificates system, bypassing the need to physically disassemble the device. The technique involved instructing the Alice voice assistant to play music and then probing for administrator privileges on the hardware. Yandex confirmed the vulnerability and has begun distributing an over-the-air update to close the access vector. Root privileges enable users to modify device software with far fewer restrictions than standard settings allow, expanding options for custom experimentation. The company emphasized that the flaw only affected a user's own device and that remote compromise of third-party units remained nearly impossible before the fix. Yandex also noted that owners previously could achieve similar customization by opening the device and flashing custom firmware, but the new method avoids any hardware intrusion. Work continues on refining the factory reset process, though specific details remain undisclosed.