Lucene search

[email protected]NVD:CVE-2018-18638

HistoryOct 24, 2018 - 10:29 p.m.

CVE-2018-18638

2018-10-2422:29:02

CWE-78

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

67.8%

JSON

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.

Affected configurations

Nvd

Node

neatoroboticsbotvac_connected_firmwareMatch2.2.0

AND

neatoroboticsbotvac_connectedMatch-

VendorProductVersionCPE
neatoroboticsbotvac_connected_firmware2.2.0cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:*
neatoroboticsbotvac_connected-cpe:2.3:h:neatorobotics:botvac_connected:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
neatorobotics	botvac_connected_firmware	2.2.0	cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:::::::*
neatorobotics	botvac_connected	-	cpe:2.3:h:neatorobotics:botvac_connected:-:::::::*

References

www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/security-in-a-vacuum-hacking-the-neato-botvac-connected-part-1/

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

67.8%

JSON

Related for NVD:CVE-2018-18638

prion1 cve1 cvelist1