Lucene search

MitreCVE-2018-19442

HistoryApr 25, 2019 - 5:29 p.m.

CVE-2018-19442

2019-04-2517:29:00

CWE-119

mitre

web.nvd.nist.gov

cve-2018-19442

buffer overflow

network

authenticationclient

verifysignature

neato botvac

remote code execution

root privileges

post request

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.02

Percentile

88.9%

JSON

A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud URI on the nucleo.neatocloud.com web site (port 4443).

Affected configurations

Nvd

Node

neatoroboticsbotvac_connected_firmwareMatch2.2.0

AND

neatoroboticsbotvac_connectedMatch-

VendorProductVersionCPE
neatoroboticsbotvac_connected_firmware2.2.0cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:*
neatoroboticsbotvac_connected-cpe:2.3:h:neatorobotics:botvac_connected:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
neatorobotics	botvac_connected_firmware	2.2.0	cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:::::::*
neatorobotics	botvac_connected	-	cpe:2.3:h:neatorobotics:botvac_connected:-:::::::*

References

media.ccc.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779

www.usenix.org/system/files/woot19-paper_ullrich.pdf

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.02

Percentile

88.9%

JSON

Related for CVE-2018-19442