What’s Vulnerable › Vulnerabilities

CVE-2018-17178

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-09-18 · updated 2026-06-17

Description

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though the web socket replies with { "message" : "invalid authorization header" }. Without an active session, commands are still interpreted, but (except for eco-on and eco-off) have no effect, since without active driving, a driving direction does not change anything.

Affected products

• Neatorobotics Botvac D3 Connected Firmware: 2.2.0
• Neatorobotics Botvac D4 Connected Firmware: 2.2.0
• Neatorobotics Botvac D5 Connected Firmware: 2.2.0
• Neatorobotics Botvac D6 Connected Firmware: 2.2.0
• Neatorobotics Botvac D7 Connected Firmware: 2.2.0

References

• https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners
• https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners

Get alerted when CVE-2018-17178 or the next vulnerability affects your stack