CVE-2018-17933

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

Design/Logic Flaw

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

Command injection

If an attacker has access to the firmware from the VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected they may be able to extract credentials...

CVE-2018-8858

If an attacker has access to the firmware from the VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected they may be able to extract credentials...

Remote code execution

If an attacker has physical access to the VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected they may be able to alter scripts, which may allow code execution with root privileges...

CVE-2018-17931

The CVE-2018-17931 entry affects Vecna’s VGo Robot (versions 3.0.3.52164 and 3.0.3.53662; earlier versions may be affected). The vulnerability is described as improper access control that could let an attacker with physical access alter scripts, enabling code execution with root privileges. Publi...

CVE-2018-17933

CVE-2018-17933 affects Vecna VGo Robot versions 3.0.3.52164 and 3.0.3.53662 (and earlier). The root issue is improper authorization, allowing user accounts to execute commands outside their privileges, potentially within admin scope, when connected via VGo XAMPP. The IV (under Update A) notes an ...

CVE-2018-17933

VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client...

CVE-2018-17931

If an attacker has physical access to the VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected they may be able to alter scripts, which may allow code execution with root privileges...

CVE-2018-8858

The CVE-2018-8858 issue affects Vecna VGo Robot firmware versions 3.0.3.52164 and 3.0.3.53662 (prior versions may be affected). The vulnerability corresponds to CVE-2018-8858: insufficiently protected credentials that could allow an attacker with firmware access to extract credentials. ICS-CERT u...

CVE-2018-8858

If an attacker has access to the firmware from the VGo Robot Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected they may be able to extract credentials...

CVE-2018-18638

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint...

CVE-2018-18638

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint...

Command injection

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint...

IBM Robotic Process Automation with Automation Anywhere Enterprise Cross-Site Scripting Vulnerability

IBM Robotic Process Automation with Automation Anywhere Enterprise is a suite of process automation solutions developed by IBM USA and Automation Anywhere. A cross-site scripting vulnerability exists in IBM Robotic Process Automation with Automation Anywhere Enterprise version 10, which stems fro...

Security Bulletin: IBM Security Guardium is affected by a Public disclosed vulnerability from Bouncy Castle

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-13098 DESCRIPTION: Bouncy Castle could allow a remote attacker to obtain sensitive information, caused by an RSA Adaptive Chosen Ciphertext Bleichenbacher attack. By utilizing...

The ROBOT Attack - Return of Bleichenbacher's Oracle Threat

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key...

Friday Squid Blogging: New Tool for Grabbing Squid and other Fragile Sea Creatures

Interesting video of a robot grabber that's delicate enough to capture squid and even jellyfish in the ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Security Glitch in IoT Camera Enabled Remote Monitoring

Swann has patched a flaw in its connected cameras that would allow a remote attacker to access their video feeds. A research team, consisting of Andrew Tierney, Chris Wade and Ken Munro from Pen Test Partners, as well as security researchers Alan Woodward, Scott Helme and Vangelis Stykas, develop...

CVE-2018-10635

In Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100, ports 30001/TCP to 30003/TCP listen for arbitrary URScript code and execute the code. This enables a remote attacker who has access to the ports to remotely execute code that may allow root access to be obtained...