CVE-2018-18638

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:h:neatorobotics:botvac_connected:-:*:*:*:*:*:*:*

Information

Published : 2018-10-24 15:29

Updated : 2019-10-02 17:03


NVD link : CVE-2018-18638

Mitre link : CVE-2018-18638


JSON object : View

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Advertisement

dedicated server usa

Products Affected

neatorobotics

  • botvac_connected_firmware
  • botvac_connected