Back to Database
Status published
High
CVE-2018-18638
A command injection vulnerability in the setup API in the...
Vulnerability Description
A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18638
Credits & Attribution
No credits recorded in the NVD database.
More from neatorobotics
View All →CVE-2018-20785
Secure boot bypass and memory extraction can be achieved on...
High
7.4
CVE-2018-19442
A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac...
Critical
9.8
CVE-2018-19441
An issue was discovered in Neato Botvac Connected 2.2.0. The...
Medium
4.7
CVE-2018-17178
An issue was discovered on Neato Botvac Connected 2.2.0 devices....
Medium
5.3
CVE-2018-17177
An issue was discovered on Neato Botvac Connected 2.2.0 and...
Low
2.4
Affected Vendor
neatorobotics
View all reports →Affected Software
botvac connected firmware
Vulnerable Versions:
2.2.0
Timeline
Official Publish:
October 24th, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.