The increasing adoption of voice-controlled IoT devices, such as Amazon Alexa, Google Home, and Apple’s Siri, has transformed modern interactions with smart systems in various sectors, including home automation, healthcare, and industry. While these devices offer convenience and enhanced accessibility, they are also vulnerable to significant cybersecurity threats. This paper examines the security challenges associated with voice-controlled IoT systems, focusing on key vulnerabilities such as voice spoofing, man-in-the-middle attacks, insecure APIs, and data privacy concerns. Additionally, the paper explores various attack vectors, including adversarial attacks and physical tampering, and assesses current mitigation techniques like biometric voice authentication, secure data transmission, and anomaly detection. Privacy concerns are also discussed, particularly in relation to data retention and third-party access. As the use of these systems continues to grow, advanced cybersecurity measures, including quantum-resistant encryption and enhanced biometric methods, are essential for securing voice-controlled IoT devices. Furthermore, the establishment of regulatory frameworks to govern the handling of voice data is critical. This paper concludes by identifying future directions to improve the security and privacy of voice-controlled IoT devices, emphasizing the need for innovative solutions to counter an expanding array of cyberthreats.