CVE-2018-19441

An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers for robot secret_key values used for local and cloud authentication/authorization. If an attacker knows the serial number and is able to estimate the time of first provisioning of a robot, he is able to brute force the generated secret_key of the robot. This is because the entropy of the secret_key exclusively relies on these two values, due to not seeding the random generator and using several constant inputs for secret_key computation. Serial numbers are printed on the packaging and equal the MAC address of the robot.

• CWE-330

• https://www.usenix.org/system/files/woot19-paper_ullrich.pdfThird Party Advisory
• https://www.youtube.com/watch?v=k5nj7Jhwn9cThird Party Advisory
• https://www.usenix.org/system/files/woot19-paper_ullrich.pdfThird Party Advisory
• https://www.youtube.com/watch?v=k5nj7Jhwn9cThird Party Advisory

Published

Jan 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19435An issue was discovered in the Sales component in webERP 4.1…
• CVE-2018-19436An issue was discovered in the Manufacturing component in we…
• CVE-2018-19437UCMS 1.4.7 allows remote authenticated users to change the a…
• CVE-2018-19439XSS exists in the Administration Console in Oracle Secure Gl…
• CVE-2018-1944IBM Security Identity Governance and Intelligence 5.2 throug…5.1
• CVE-2018-19440ARM Trusted Firmware-A allows information disclosure.5.3
• CVE-2018-19442A Buffer Overflow in Network::AuthenticationClient::VerifySi…
• CVE-2018-19443The client in Tryton 5.x before 5.0.1 tries to make a connec…
• CVE-2018-19444A use after free in the TextBox field Validate action in IRe…
• CVE-2018-19445A command injection can occur for specially crafted PDF file…
• CVE-2018-19446A File Write can occur for specially crafted PDF files in Fo…
• CVE-2018-19447A stack-based buffer overflow can occur for specially crafte…