CVE-2018-17933

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User accounts may be able to execute commands that are outside the scope of their privileges and within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179349.8NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the in CVE-2018-179358.1All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This CVE-2018-179369.8NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to CVE-2018-179378.8gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow r CVE-2018-179385.3Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.CVE-2018-179397.5An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. The CVE-2018-17946.1IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows use CVE-2018-179428.8The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated CVE-2018-179444.9On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by CVE-2018-179466.1The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda CVE-2018-179476.1The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-179486.1An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.