PatchTheCVECVE-2018-17178: An issue was discovered on Neato Botvac Connected 2.2.0 devices
CVE-2018-17178 is a medium-severity flaw (CVSS 5.3) affecting botvac d4 connected firmware, botvac d6 connected firmware, botvac d5 connected firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-right, pivot-left, and pivot-right are executed even though the web socket replies with { "message" : "invalid authorization header" }. Without an active session, commands are still interpreted, but (except for ec
Why this priority
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 48%) |
| CISA exploited list | No |
| Published | 2018-09-18 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-17178?
botvac d4 connected firmware: mitigate or apply the listed mitigation; botvac d6 connected firmware: mitigate or apply the listed mitigation; botvac d5 connected firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-17178 being exploited?
CVE-2018-17178 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-17178 affect?
CVE-2018-17178 affects botvac d4 connected firmware, botvac d6 connected firmware, botvac d5 connected firmware. Severity is medium (CVSS 5.3). An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if they already have an active session. Commands like forward, back, arc-left, arc-rig
How urgent is CVE-2018-17178?
Priority 37/100. Public exploit reference
Related CVEs
- CVE-2018-20785 HIGH 7.4 MITIGATE MITIGATE Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices
- CVE-2018-17177 LOW 2.4 MITIGATE MITIGATE An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices
- CVE-2018-17176 HIGH 7.5 MITIGATE MITIGATE A replay issue was discovered on Neato Botvac Connected 2.2.0 devices