Auth bypass in Vecna Vgo
CVE-2018-17933
VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot.
EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Vecna Vgo
- Vecna Vgo_firmware — versions 3.0.3.52164, 3.0.3.53662
- N/a Vgo Robot — versions Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected.
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-17933?
- CVE-2018-17933 is a high-severity vulnerability in Vecna Vgo, classified under Improper Authorization. CVSS score: 8.8/10. Published 2018-10-30.
- How severe is CVE-2018-17933?
- High severity. CVSS v3 base score is 8.8 out of 10.