How severe is CVE-2018-17177?

CVE-2018-17177 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2018-17177 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-17177?

CVE-2018-17177 primarily affects Neatorobotics Botvac D4 Connected Firmware. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-17177?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-17177 published?

CVE-2018-17177 was published on 2018-09-18 and last updated on 2026-06-17.

CVE-2018-17177

CVE-2018-17177 is a low-severity vulnerability in Neatorobotics Botvac D4 Connected Firmware with a CVSS 3.x base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-326.

Key facts

Severity: Low (CVSS 3.x base score 2.4)
CVSS v2: 2.1
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-326
Affected product: Neatorobotics Botvac D4 Connected Firmware
Published: 2018-09-18
Last modified: 2026-06-17

Description

An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (event logs and core dumps) to a USB stick. These logs are RC4-encrypted with a 9-character password of *^JEd4W!I that is obfuscated by hiding it within a custom /bin/rc4_crypt binary.

Frequently asked questions

What is CVE-2018-17177?: An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (event logs and core dumps) to a USB stick. These logs are RC4-encrypted with a 9-character password of *^JEd4W!I that is obfuscated by hiding it within a custom /bin/rc4_crypt binary.
How severe is CVE-2018-17177?: CVE-2018-17177 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2018-17177 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-17177?: CVE-2018-17177 primarily affects Neatorobotics Botvac D4 Connected Firmware. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-17177?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-17177 published?: CVE-2018-17177 was published on 2018-09-18 and last updated on 2026-06-17.

References

https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners

Affected products (6)

cpe:2.3:o:neatorobotics:botvac_d4_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d6_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d5_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d7_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d3_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_85_firmware:1.2.1:*:*:*:*:*:*:*

More vulnerabilities in Neatorobotics Botvac D4 Connected Firmware

CVE-2018-17176 — High (CVSS 7.5): A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but…
CVE-2018-20785 — High (CVSS 7.4): Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the…
CVE-2018-17178 — Medium (CVSS 5.3): An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands…

All CVEs affecting Neatorobotics Botvac D4 Connected Firmware →

Other CWE-326 (Inadequate Encryption Strength) vulnerabilities

CVE-2026-44523 — Critical (CVSS 10.0): Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the…
CVE-2020-6966 — Critical (CVSS 10.0): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information…
CVE-2014-9199 — Critical (CVSS 10.0): The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the…
CVE-2018-25272 — Critical (CVSS 9.8): ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and…
CVE-2025-12478 — Critical (CVSS 9.8): Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2022-24116 — Critical (CVSS 9.8): Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II…

Browse all CWE-326 (Inadequate Encryption Strength) vulnerabilities →