CVE-2018-20785: Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices
41
This month
HIGH 7.4MITIGATEMITIGATEMITIGATE
CVE-2018-20785 is a high-severity flaw (CVSS 7.4) affecting botvac d4 connected firmware, botvac d6 connected firmware, botvac d5 connected firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of
Why this priority
High severity
Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
neatorobotics botvac d3 pro connected firmware MITIGATE
Affected: 2.2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.2.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-20785?
botvac d4 connected firmware: mitigate or apply the listed mitigation; botvac d6 connected firmware: mitigate or apply the listed mitigation; botvac d5 connected firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-20785 being exploited?
CVE-2018-20785 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-20785 affect?
CVE-2018-20785 affects botvac d4 connected firmware, botvac d6 connected firmware, botvac d5 connected firmware. Severity is high (CVSS 7.4). Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands t
How urgent is CVE-2018-20785?
Priority 41/100. High severity; Public exploit reference
Related CVEs
CVE-2018-17178MEDIUM 5.3MITIGATEMITIGATE An issue was discovered on Neato Botvac Connected 2.2.0 devices
CVE-2018-17177LOW 2.4MITIGATEMITIGATE An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices
CVE-2018-17176HIGH 7.5MITIGATEMITIGATE A replay issue was discovered on Neato Botvac Connected 2.2.0 devices
PatchTheCVE