Multiple vulnerabilities in Vecna VGo Celia
| Risk | Low |
| Patch available | NO |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-8858 CVE-2018-17931 CVE-2018-17933 |
| CWE-ID | CWE-522 CWE-284 CWE-285 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
VGo Celia Hardware solutions / Firmware |
| Vendor | Vecna Technologies |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU15425
Risk: Low
CVSSv3.1: 6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-8858
CWE-ID:
CWE-522 - Insufficiently Protected Credentials
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.
The weakness exists due to insufficiently protected credentials. An adjacent attacker can recover WiFi passwords that the robot uses to connect to an organization's internal network or the XMPP credentials that the robot owner uses to connect to the device from remote locations.
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
VGo Celia: 1.4.2 - 3.0.3.52164
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper access control
EUVDB-ID: #VU15426
Risk: Low
CVSSv3.1: 8.1 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-17931
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges on the target system.
The weakness exists due to improper access control. An adjacent attacker can plug in a USB thumb drive into a robot, cause the robot's firmware to execute a file hosted on the USB stick (/config/startup.script) with root privileges, giving the attacker the opportunity to hijack the device.
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
VGo Celia: 1.4.2 - 3.0.3.52164
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper authorization
EUVDB-ID: #VU15427
Risk: Low
CVSSv3.1: 5.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-17933
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to bypass authorization on the target system.
The weakness exists in the XMPP client due to improper authorization. An adjacent attacker can access telepresence robot's internal functions and execute arbitrary commands.
Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.
VGo Celia: 1.4.2 - 3.0.3.52164
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
