Read the docs
TI-2018-13764 Aliases CVE-2018-19441GHSA-4f4h-4mvr-gm9g

An issue was discovered in Neato Botvac Connected 2.2.0.

Priority LOW 21CWE-330Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorization. If an attacker knows the serial number and is able to estimate the time of first provisioning of a robot, he is able to brute force the generated secret_key of the robot. This is because the entropy of the secret_key exclusively relies on these two values, due to not seeding the random generator and using several constant inputs for secret_key computation. Serial numbers are printed on the packaging and equal the MAC address of the robot.

Why it matters now

EPSS 0.00296 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableNeatorobotics
cpe:2.3:h:neatorobotics:botvac_connected:-:*:*:*:*:*:*:*not specified by NVDRunning onNeatorobotics
  • cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Neatorobotics
  • cpe:2.3:h:neatorobotics:botvac_connected:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Neatorobotics

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19441
  2. 2026-10-03 Alias added: GHSA-4f4h-4mvr-gm9g

References

Advisory 2

  • TI-2018-13765 A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in… CVSS 3.0CRITICAL 9.8
  • TI-2018-13174 A command injection vulnerability in the setup API in the Neato Botvac Connected 2.2.0… CVSS 3.0HIGH 8.1
  • TI-2018-14756 Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0… CVSS 3.0HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences