CVE-2018-6826

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers can execute arbitrary code by watching for a local user to launch the Breakout Easter Egg feature, and then sending a crafted HTTP response.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-02-09

Last modified

2024-08-05

Affected products

• Vobot Firmware (Omninova)

References

• http://stacksmashing.net/CVE-2018-6826.html