CVE-2018-6827
HIGHVOBOT CLOCK < 0.99.30 - Improper Certificate Validation via Wget
Title source: llmDescription
VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information, and consequently execute arbitrary code, via a crafted certificate, as demonstrated by leveraging a hardcoded --no-check-certificate Wget option.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
http://stacksmashing.net/CVE-2018-6827.html
Scores
CVSS v3
8.1
EPSS
0.0093
EPSS Percentile
55.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-295
Status
published
Products (1)
omninova/vobot_firmware
< 0.99.30
Published
Feb 09, 2018
Tracked Since
Feb 18, 2026