CVE-2018-17178

MEDIUM

5.3

Descricao

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though the web socket replies with { "message" : "invalid authorization header" }. Without an active session, commands are still interpreted, but (except for eco-on and eco-off) have no effect, since without active driving, a driving direction does not change anything.

Detalhes CVE

Pontuacao CVSS v3.15.3

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Vetor de ataqueADJACENT_NETWORK

ComplexidadeHIGH

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado9/18/2018

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

neatorobotics:botvac_d3_connectedneatorobotics:botvac_d3_connected_firmwareneatorobotics:botvac_d4_connectedneatorobotics:botvac_d4_connected_firmwareneatorobotics:botvac_d5_connectedneatorobotics:botvac_d5_connected_firmwareneatorobotics:botvac_d6_connectedneatorobotics:botvac_d6_connected_firmwareneatorobotics:botvac_d7_connectedneatorobotics:botvac_d7_connected_firmware

Referencias

https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners(cve@mitre.org)

https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.