1. Home
  2. CVE Database
  3. CVE-2018-20785
HIGH · 7.4

CVE-2018-20785

Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypa...

Vulnerability Description

Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.

CVSS Score

7.4

HIGH

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
NeatoroboticsBotvac D4 Connected Firmware2.2.0
NeatoroboticsBotvac D4 Connected-
NeatoroboticsBotvac D6 Connected Firmware2.2.0
NeatoroboticsBotvac D6 Connected-
NeatoroboticsBotvac D5 Connected Firmware2.2.0
NeatoroboticsBotvac D5 Connected-
NeatoroboticsBotvac D7 Connected Firmware2.2.0
NeatoroboticsBotvac D7 Connected-
NeatoroboticsBotvac D3 Connected Firmware2.2.0
NeatoroboticsBotvac D3 Connected-
NeatoroboticsBotvac D3 Pro Connected Firmware2.2.0
NeatoroboticsBotvac D3 Pro Connected-
NeatoroboticsBotvac Connected Firmware2.2.0
NeatoroboticsBotvac Connected-

References

FAQ

What is CVE-2018-20785?

CVE-2018-20785 is a vulnerability with a CVSS score of 7.4 (HIGH). Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypa...

How severe is CVE-2018-20785?

CVE-2018-20785 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-20785?

Check the references section above for vendor advisories and patch information. Affected products include: Neatorobotics Botvac D4 Connected Firmware, Neatorobotics Botvac D4 Connected, Neatorobotics Botvac D6 Connected Firmware, Neatorobotics Botvac D6 Connected, Neatorobotics Botvac D5 Connected Firmware.