Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
neato vulnerabilities and exploits
(subscribe to this query)
10
CVSSv2
CVE-2018-19442
A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote malicious user to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud...
Neatorobotics Botvac Connected Firmware 2.2.0
9.3
CVSSv2
CVE-2018-18638
A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network malicious users to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.
Neatorobotics Botvac Connected Firmware 2.2.0
5
CVSSv2
CVE-2018-17176
A replay issue exists on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be replayed to /bin/webserver on port 8081. There are no nonces, and timestamps are not checked ...
Neatorobotics Botvac D4 Connected Firmware 2.2.0
Neatorobotics Botvac D6 Connected Firmware 2.2.0
Neatorobotics Botvac D7 Connected Firmware 2.2.0
2.1
CVSSv2
CVE-2018-17177
An issue exists on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (event logs and core dumps) to a USB stick. These logs are RC4-encrypted with a 9-character password of *^JEd4W!I that is...
Neatorobotics Botvac D4 Connected Firmware 2.2.0
Neatorobotics Botvac D6 Connected Firmware 2.2.0
Neatorobotics Botvac D5 Connected Firmware 2.2.0
Neatorobotics Botvac D7 Connected Firmware 2.2.0
Neatorobotics Botvac D3 Connected Firmware 2.2.0
Neatorobotics Botvac 85 Firmware 1.2.1
2.9
CVSSv2
CVE-2018-17178
An issue exists on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed eve...
Neatorobotics Botvac D4 Connected Firmware 2.2.0
Neatorobotics Botvac D6 Connected Firmware 2.2.0
Neatorobotics Botvac D5 Connected Firmware 2.2.0
Neatorobotics Botvac D7 Connected Firmware 2.2.0
Neatorobotics Botvac D3 Connected Firmware 2.2.0
1.9
CVSSv2
CVE-2018-19441
An issue exists in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorization. If an attacker knows the serial number and is ...
Neatorobotics Botvac Connected Firmware 2.2.0
4.4
CVSSv2
CVE-2018-20785
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power ...
Neatorobotics Botvac D4 Connected Firmware 2.2.0
Neatorobotics Botvac D6 Connected Firmware 2.2.0
Neatorobotics Botvac D5 Connected Firmware 2.2.0
Neatorobotics Botvac D7 Connected Firmware 2.2.0
Neatorobotics Botvac D3 Connected Firmware 2.2.0
Neatorobotics Botvac D3 Pro Connected Firmware 2.2.0
Neatorobotics Botvac Connected Firmware 2.2.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-3675
CVE-2024-3400
CVE-2024-23557
mass assignment
CVE-2023-1389
local file inclusion
CVE-2024-32596
file upload
CVE-2024-32593
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started