How severe is CVE-2018-20785?

CVE-2018-20785 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-20785 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-20785?

CVE-2018-20785 primarily affects Neatorobotics Botvac D4 Connected Firmware. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-20785?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2018-20785 published?

CVE-2018-20785 was published on 2019-02-23 and last updated on 2026-06-17.

CVE-2018-20785

CVE-2018-20785 is a high-severity vulnerability in Neatorobotics Botvac D4 Connected Firmware with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.4)
CVSS v2: 4.4
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Neatorobotics Botvac D4 Connected Firmware
Published: 2019-02-23
Last modified: 2026-06-17

Description

Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.

Frequently asked questions

What is CVE-2018-20785?: Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.
How severe is CVE-2018-20785?: CVE-2018-20785 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-20785 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-20785?: CVE-2018-20785 primarily affects Neatorobotics Botvac D4 Connected Firmware. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-20785?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2018-20785 published?: CVE-2018-20785 was published on 2019-02-23 and last updated on 2026-06-17.

References

https://media.ccc.de/v/2018-124-pinky-brain-are-taking-over-the-world-with-vacuum-cleaners#t=745

Affected products (7)

cpe:2.3:o:neatorobotics:botvac_d4_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d6_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d5_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d7_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d3_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_d3_pro_connected_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:o:neatorobotics:botvac_connected_firmware:2.2.0:*:*:*:*:*:*:*

More vulnerabilities in Neatorobotics Botvac D4 Connected Firmware

CVE-2018-17176 — High (CVSS 7.5): A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but…
CVE-2018-17178 — Medium (CVSS 5.3): An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands…
CVE-2018-17177 — Low (CVSS 2.4): An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the…

All CVEs affecting Neatorobotics Botvac D4 Connected Firmware →