CVE-2018-18638

8.1 highEPSS 2.8%

High (8.1) in neatorobotics botvac connected firmware. EPSS 2.8% chance of exploitation in the next 30 days.

A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0 allows network attackers to execute arbitrary commands via shell metacharacters in the ntp field within JSON data to the /robot/initialize endpoint.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2018-10-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

neatorobotics:botvac_connected_firmware

References

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/security-in-a-vacuum-hacking-the-neato-botvac-connected-part-1/
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/security-in-a-vacuum-hacking-the-neato-botvac-connected-part-1/

Check your stack JSON