PT-2018-13937 · Neato · Neato Botvac Connected+1

Publicado 2018-09-18 · Atualizado 2021-06-17 · CVE-2018-17177

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Baixa

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Neato Botvac Connected version 2.2.0 Neato Botvac 85 version 1.2.1

Description An issue was discovered where static encryption is used for copying event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password *^JEd4W!I that is obfuscated within a custom /bin/rc4 crypt binary.

Recommendations For Neato Botvac Connected version 2.2.0, consider disabling the use of static encryption for log copying until a secure method is implemented. For Neato Botvac 85 version 1.2.1, restrict access to the /bin/rc4 crypt binary to minimize the risk of exploitation. Avoid using the *^JEd4W!I password in any other security contexts to prevent potential abuse.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2018-17177

Produtos afetados

Neato Botvac 85

Neato Botvac Connected

Referências · 3

• 🔥 https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners · Exploit
• https://osv.dev/vulnerability/CVE-2018-17177 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17177 · Nota de Segurança