Critical severity · published Apr 25, 2019
CVE-2018-19442
A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root…
9.8
CVSS
7.5%
EPSS
No
On KEV
Description
A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud URI on the nucleo.neatocloud.com web site (port 4443).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Botvac Connected Firmware · Neatorobotics
2.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19442
Exploit
https://media.ccc.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779
www.usenix.org
https://www.usenix.org/system/files/woot19-paper_ullrich.pdf
More from Botvac Connected Firmware
8.1
CVE-2018-18638
A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp…
7.4
CVE-2018-20785
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices
4.7
CVE-2018-19441
An issue was discovered in Neato Botvac Connected 2.2.0