What is the CVSS score of CVE-2018-17178?

CVE-2018-17178 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.7%.

Is there a public PoC exploit available for CVE-2018-17178?

Yes, a public proof-of-concept exploit is available for CVE-2018-17178. Prioritise patching immediately. EPSS: 0.7%.

Botvac D4 Connected Firmware CVE-2018-17178

MEDIUM

2018-09-18 cve@mitre.org

Information Disclosure Botvac D4 Connected Firmware Botvac D6 Connected Firmware Botvac D5 Connected Firmware Botvac D7 Connected Firmware Botvac D3 Connected Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Sep 18, 2018 - 18:29 nvd

MEDIUM 5.3

DescriptionNVD

AnalysisAI

An issue was discovered on Neato Botvac Connected 2.2.0 devices. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.

Technical ContextAI

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though the web socket replies with { "message" : "invalid authorization header" }. Without an active session, commands are still interpreted, but (except for eco-on and eco-off) have no effect, since without active driving, a driving direction does not change anything. Affected products include: Neatorobotics Botvac D4 Connected Firmware, Neatorobotics Botvac D6 Connected Firmware, Neatorobotics Botvac D5 Connected Firmware, Neatorobotics Botvac D7 Connected Firmware, Neatorobotics Botvac D3 Connected Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.