CVE-2018-4018

An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability.

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:anker-in:roav_dashcam_a1_firmware:1.9:*:*:*:*:*:*:*

cpe:2.3:h:anker-in:roav_dashcam_a1:-:*:*:*:*:*:*:*

History

07 Jun 2022, 16:45

Type	Values Removed	Values Added
CWE	~~CWE-20~~	NVD-CWE-noinfo

Information

Published : 2019-05-13 16:29

Updated : 2023-12-10 12:59

NVD link : CVE-2018-4018

Mitre link : CVE-2018-4018

CVE.ORG link : CVE-2018-4018

JSON object : View

Products Affected

anker-in

roav_dashcam_a1
roav_dashcam_a1_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-4018", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-05-13T16:29:00.647", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server allows for arbitrary firmware binaries to be uploaded which will be flashed upon next reboot. An attacker can send an HTTP PUT request or upgrade firmware request to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad explotable de actualizaci\u00f3n de firmware en NT9665X Chipset firmware ejecutado en Anker Roav A1 Dashcam, versi\u00f3n RoavA1SWV1.9. El servidor HTTP permite que binarios de firmware arbitrarios sean cargados que ser\u00e1n actualizados en el pr\u00f3ximo reinicio. Un atacante puede enviar una petici\u00f3n HTTP PUT o actualizar una petici\u00f3n de firmware para activar esta vulnerabilidad."}], "lastModified": "2022-06-07T16:45:32.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:anker-in:roav_dashcam_a1_firmware:1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16B50E96-75F8-4F33-B871-E1F1DFE2AC14"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:anker-in:roav_dashcam_a1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "470D4C8D-670E-43F7-8DF3-F2BFBC48CB82"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}