PT-2019-10755 · Anker · Anker Roav A1 Dashcam

Published 2019-05-13 · Updated 2022-06-07 · CVE-2018-4018

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anker Roav A1 Dashcam version RoavA1SWV1.9

Description A firmware update issue exists, allowing arbitrary firmware binaries to be uploaded via the HTTP server, which will be flashed upon next reboot. An attacker can exploit this by sending an HTTP PUT request or an upgrade firmware request.

Recommendations For Anker Roav A1 Dashcam version RoavA1SWV1.9, as a temporary workaround, consider restricting access to the HTTP server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2018-4018

Affected Products

Anker Roav A1 Dashcam

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-4018 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4018 · Vendor Advisory