Login Sign Up

CVE-2018-4018

9.8 CRITICAL

📋 TL;DR

This vulnerability allows attackers to upload arbitrary firmware to Anker Roav A1 dashcams via the HTTP server, enabling complete device compromise. Attackers can send HTTP PUT requests or firmware upgrade requests to install malicious firmware that executes upon reboot. Only users of Anker Roav A1 dashcams with vulnerable firmware are affected.

💻 Affected Systems

Products:
  • Anker Roav A1 Dashcam
Versions: RoavA1SWV1.9
Operating Systems: Embedded firmware
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists in NT9665X chipset firmware implementation

📦 What is this software?

Roav Dashcam A1 Firmware by Anker In

View all CVEs affecting Roav Dashcam A1 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device takeover allowing persistent malware installation, data theft, device bricking, or use as attack platform

🟠

Likely Case

Malicious firmware installation enabling surveillance, data collection, or device disruption

🟢

If Mitigated

No impact if firmware validation is implemented or device is isolated from untrusted networks

🌐 Internet-Facing: HIGH - HTTP server accessible over network allows remote exploitation
🏢 Internal Only: HIGH - Even on internal networks, any attacker with network access can exploit

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP PUT request with malicious firmware binary is sufficient for exploitation

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Later than RoavA1SWV1.9

Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0689

Restart Required: Yes

Instructions:

1. Check current firmware version. 2. Contact Anker support for updated firmware. 3. Download and install updated firmware via official update process. 4. Reboot device to apply changes.

🔧 Temporary Workarounds

Network Isolation

all

Isolate dashcam from untrusted networks to prevent HTTP access

Firewall Rules

linux

Block HTTP PUT requests to dashcam IP address

iptables -A INPUT -p tcp --dport 80 -m string --string "PUT" --algo bm -j DROP

🧯 If You Can't Patch

  • Disconnect dashcam from network entirely
  • Place dashcam behind strict firewall allowing only outbound connections

🔍 How to Verify

Check if Vulnerable:

Check firmware version in device settings - if RoavA1SWV1.9, device is vulnerable

Check Version:

Check device settings menu for firmware version information

Verify Fix Applied:

Verify firmware version is updated to version later than RoavA1SWV1.9

📡 Detection & Monitoring

Log Indicators:

  • HTTP PUT requests to dashcam IP
  • Firmware update logs showing unauthorized updates

Network Indicators:

  • HTTP PUT requests to port 80 of dashcam IP
  • Large firmware file transfers to dashcam

SIEM Query:

sourceIP="dashcam_ip" AND (http_method="PUT" OR uri CONTAINS "firmware")

📊 Metadata

CVE ID: CVE-2018-4018
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: May 13, 2019
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON