Unscored CVE-2018-18638 EUVD-2018-10354GHSA-96cj-c95w-hg9m

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary comman…

Published Oct 24, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.

References

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/security-in-a-vacuum-hacking-the-neato-botvac-connected-part-1/