PT-2018-13937 · Neato · Neato Botvac Connected+1

Published 2018-09-18 · Updated 2021-06-17 · CVE-2018-17177

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Neato Botvac Connected version 2.2.0 Neato Botvac 85 version 1.2.1

Description An issue was discovered where static encryption is used for copying event logs and core dumps to a USB stick. These logs are RC4-encrypted with a 9-character password *^JEd4W!I that is obfuscated within a custom /bin/rc4 crypt binary.

Recommendations For Neato Botvac Connected version 2.2.0, consider disabling the use of static encryption for log copying until a secure method is implemented. For Neato Botvac 85 version 1.2.1, restrict access to the /bin/rc4 crypt binary to minimize the risk of exploitation. Avoid using the *^JEd4W!I password in any other security contexts to prevent potential abuse.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2018-17177

Affected Products

Neato Botvac 85

Neato Botvac Connected

References · 3

• 🔥 https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners · Exploit
• https://osv.dev/vulnerability/CVE-2018-17177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17177 · Security Note