How severe is CVE-2018-4018?

CVE-2018-4018 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-4018 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-4018?

CVE-2018-4018 affects Anker-in Roav Dashcam A1 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-4018?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-4018 published?

CVE-2018-4018 was published on 2019-05-13 and last updated on 2026-06-17.

CVE-2018-4018

CVE-2018-4018 is a critical-severity vulnerability in Anker-in Roav Dashcam A1 Firmware with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 2% (82nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Anker-in Roav Dashcam A1 Firmware
Published: 2019-05-13
Last modified: 2026-06-17

Description

An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability.

Frequently asked questions

What is CVE-2018-4018?: An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability.
How severe is CVE-2018-4018?: CVE-2018-4018 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-4018 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-4018?: CVE-2018-4018 affects Anker-in Roav Dashcam A1 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-4018?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-4018 published?: CVE-2018-4018 was published on 2019-05-13 and last updated on 2026-06-17.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689

Affected products (1)

cpe:2.3:o:anker-in:roav_dashcam_a1_firmware:1.9:*:*:*:*:*:*:*

More vulnerabilities in Anker-in Roav Dashcam A1 Firmware

CVE-2018-4029 — Critical (CVSS 9.8): An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware…
CVE-2018-4023 — Critical (CVSS 9.8): An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware,…
CVE-2018-4014 — Critical (CVSS 9.8): An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version…
CVE-2018-4017 — High (CVSS 8.8): An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version…
CVE-2018-4016 — High (CVSS 8.8): An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running…
CVE-2018-4028 — High (CVSS 7.5): An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1…

All CVEs affecting Anker-in Roav Dashcam A1 Firmware →