CVE-2018-17933: vecna vgo_firmware Improper Authorization

Vulnerability summary

CVE-2018-17933 is a high (CVSS 8.8) Improper Authorization vulnerability in vecna vgo_firmware. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68% of scored vulnerabilities.

Timeline

1. 30-10-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.