CVE-2018-18638

Neato Botvac Connected 2.2.0 is affected by a command-injection in the setup API. The vulnerability allows remote attackers to inject shell metacharacters in the ntp field of a JSON payload sent to /robot/initialize, enabling arbitrary command execution. Root cause: unsafely handled ntp field in ...

CVE-2018-18638: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint...

PT-2018-14550

Name of the Vulnerable Software and Affected Versions Neato Botvac Connected version 2.2.0 Description A command injection issue exists in the setup API, allowing network attackers to execute arbitrary commands. This is achieved by using shell metacharacters in the ntp field within JSON data sent...