CVE-2018-20785

CVE-2018-20785 affects Neato Botvac Connected 2.2.0. The AM335x secure boot can be bypassed by issuing certain commands to the USB serial port during startup, allowing execution of an unsigned QNX IFS image via a boot menu (XMODEM). A power cycle does not fully reset the chip, leaving memory cont...

CVE-2018-17177

CVE-2018-17177 affects Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1. The issue is that static RC4 encryption is used to copy log data (event logs and core dumps) to a USB stick, with a 9-character password. The password is obfuscated inside a custom /bin/rc4_crypt binary, implying weak and po...

CVE-2018-17176

CVE-2018-17176 affects Neato Botvac Connected 2.2.0. The issue enables replay of an authenticated session: manual control mode requires authentication, but the authentication credentials (transmitted in cleartext) can be replayed to /bin/webserver on port 8081. There are no nonces and timestamps ...

CVE-2018-17178

The CVE affects Neato Botvac Connected 2.2.0 devices. When an active session exists, unauthenticated manual drive commands sent to /bin/webserver:8081 (e.g., forward, back, arc-left, arc-right, pivot-left, pivot-right) can be executed despite the websocket returning {"message": "invalid authoriza...