Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Neato Botvac 2.2.0 lets recorded login be reused

CVE-2018-17176 · published 8 years ago
Summary

The 2.2.0 firmware on Neato Botvac models (D4, D6, D7) sends the manual‑control password in plain text and does not check that each request is new. An attacker who captures that traffic can replay the same login to take control of the robot over the local network. Update the device to a newer firmware version that encrypts the credentials or restrict network access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
neatorobotics botvac_d4_connected_firmware 2.2.0
cpe:2.3:o:neatorobotics:botvac_d4_connected_firmware:2.2.0:*:*:*:*:*:*:*
neatorobotics botvac_d6_connected_firmware 2.2.0
cpe:2.3:o:neatorobotics:botvac_d6_connected_firmware:2.2.0:*:*:*:*:*:*:*
neatorobotics botvac_d7_connected_firmware 2.2.0
cpe:2.3:o:neatorobotics:botvac_d7_connected_firmware:2.2.0:*:*:*:*:*:*:*
Original advisory text
A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be re...
A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (always transmitted in cleartext) can be replayed to /bin/webserver on port 8081. There are no nonces, and timestamps are not checked at all.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-294Authentication Bypass by Capture-replay
Timeline
Published18 Sep 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-17176 · NVD
Track software like this
Free during beta