CVE-2018-6825

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-68267.5An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-tCVE-2018-68278.1VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servCVE-2018-68297.5cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers tCVE-2018-68307.5Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI985CVE-2018-68317.2The setSystemTime function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, CVE-2018-68327.5Stack-based buffer overflow in the getSWFlag function in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P VCVE-2018-68346.1static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.CVE-2018-68359.8node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restCVE-2018-68369.8The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory aCVE-2018-68425.4Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.CVE-2018-68437.2Kentico 10 before 10.0.50 and 11 before 11.0.3 has SQL injection in the administration interface.CVE-2018-68445.4MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen.
CVE-2018-6825: Critical severity, CVSS 9.8 | Vulnix