Read the docs
TI-2018-06402 Aliases CVE-2018-8860GHSA-4w26-4rcj-vffr

Information disclosure in ICS-CERT VGo Robot

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker may be able to capture firmware updates through the adjacent network.

Why it matters now

EPSS 0.00639 50th percentileScored 2026-11-07
Fix Fixed VGo Robot (ICS-CERT): 3.0.3.52164

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ICS-CERTVGo Robotbefore 3.0.3.521643.0.3.52164Patch availableCNA
  • VGo Robot VendorICS-CERT Affected before 3.0.3.52164 Fixed in 3.0.3.52164 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:vecna:vgo_firmware:*:*:*:*:*:*:*:*before 3.0.3.52164VulnerableVecna
cpe:2.3:h:vecna:vgo:-:*:*:*:*:*:*:*not specified by NVDRunning onVecna
  • cpe:2.3:o:vecna:vgo_firmware:*:*:*:*:*:*:*:* Versions before 3.0.3.52164 Vulnerable ·Vecna
  • cpe:2.3:h:vecna:vgo:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Vecna

Remediation

  • Fix · CNA VGo Robot (ICS-CERT) Fixed in 3.0.3.52164

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8860
  2. 2026-10-03 Alias added: GHSA-4w26-4rcj-vffr
  3. 2026-10-14 EPSS moved to the 50th–90th percentile
  4. 2026-10-18 EPSS moved to the below the 50th percentile
  5. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2018-06400 Insufficiently protected credentials in VGo Robot CVSS 3.0CRITICAL 9.8
  • TI-2018-06408 In Vecna VGo Robot versions prior to 3.0.3.52164, an attacker on an adjacent network could perform command injection. CVSS 3.0HIGH 8.8
  • TI-2018-12764 Improper authorization in VGo Robot CVSS 3.0HIGH 8.8
  • TI-2018-12762 Improper access control in VGo Robot CVSS 3.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences