LiveActive security incident?Get immediate response
CVE Record

CVE-2018-20785: Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices.

Secure boot bypass and memory extraction can be achieved on Neato Botvac Connected 2.2.0 devices. During startup, the AM335x secure boot feature decrypts and executes firmware. Secure boot can be bypassed by starting with certain commands to the USB serial port. Although a power cycle occurs, this does not completely reset the chip: memory contents are still in place. Also, it restarts into a boot menu that enables XMODEM upload and execution of an unsigned QNX IFS system image, thereby completing the bypass of secure boot. Moreover, the attacker can craft custom IFS data and write it to unused memory to extract all memory contents that had previously been present. This includes the original firmware and sensitive information such as Wi-Fi credentials.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue lets someone with access to a Neato Botvac Connected 2.2.0 device bypass secure boot and recover memory contents. The described impact includes extracting original firmware and sensitive data such as Wi-Fi credentials. The sources do not show internet-scale exploitation or a named patch.

Executive priority

Prioritize where these devices connect to sensitive networks or leave trusted custody. Business urgency is mainly credential exposure and IoT trust boundary risk, not confirmed remote mass exploitation.

Technical view

During startup, the AM335x secure boot path decrypts and executes firmware. The CVE describes a USB-serial boot path that can restart into a boot menu, accept an unsigned QNX IFS image, and preserve memory across the reset, enabling memory extraction.

Likely exposure

Exposure appears limited to Neato Botvac Connected devices running firmware 2.2.0, especially devices an attacker can physically access, inspect, resell, repair, or tamper with.

Exploitation context

The source material describes a secure boot bypass and memory extraction technique, but does not cite active exploitation, KEV listing, remote exploitation, public weaponization, or confirmed vendor remediation.

Researcher notes

Evidence is sparse and centered on the CVE description plus CCC presentation reference. The affected-product metadata is incomplete in the CVE bundle, so avoid expanding scope beyond Neato Botvac Connected 2.2.0 without vendor confirmation.

Mitigation direction

  • Check Neato or vendor guidance for firmware updates or official mitigations.
  • Restrict physical access to affected devices and exposed service interfaces.
  • Segment IoT devices from business and sensitive home networks.
  • Rotate Wi-Fi credentials after device loss, resale, repair, or suspected tampering.
  • Avoid reusing Wi-Fi credentials across sensitive networks.

Validation and detection

  • Inventory Neato Botvac Connected devices and confirm firmware version 2.2.0 exposure.
  • Review asset handling procedures for device resale, repair, and disposal.
  • Check whether affected devices connect to sensitive or flat networks.
  • Verify whether any vendor update or advisory exists before changing device firmware.
  • Assess whether exposed Wi-Fi credentials require rotation.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-20785 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.