CVE-2018-10987

An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute commands on the vacuum cleaner as root. The bug is in the function REQUEST_SET_WIFIPASSWD (UDP command 153). A crafted UDP packet runs "/mnt/skyeye/mode_switch.sh %s" with an attacker controlling the %s variable. In some cases, authentication can be achieved with the default password of 888888 for the admin account.

• CWE-78

• https://gist.github.com/neolead/10b27c5c04bca84a5515783ca6f2ecb4#file-cve-2018-10987-txtThird Party Advisory
• https://gist.github.com/neolead/10b27c5c04bca84a5515783ca6f2ecb4#file-cve-2018-10987-txtThird Party Advisory

Published

Jul 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10976In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sy…
• CVE-2018-10977In 2345 Security Guard 3.7, the driver file (2345BdPcSafe.sy…
• CVE-2018-1098A cross-site request forgery flaw was found in etcd 3.3.1 an…
• CVE-2018-10981An issue was discovered in Xen through 4.10.x allowing x86 H…
• CVE-2018-10982An issue was discovered in Xen through 4.10.x allowing x86 H…
• CVE-2018-10986OX Guard 2.8.0 has CSRF.
• CVE-2018-10988An issue was discovered on Diqee Diqee360 devices. A firmwar…
• CVE-2018-10989Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices…6.6
• CVE-2018-1099DNS rebinding vulnerability found in etcd 3.3.1 and earlier.…
• CVE-2018-10990On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devi…8
• CVE-2018-10991Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10992lilypond-invoke-editor in LilyPond 2.19.80 does not validate…