9.8

CVE-2020-10271

Exploit

RVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired ones

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as appropriate. Currently, the ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws such as CVE-2020-10269, the computation graph can also be fetched and interacted from wireless networks. This allows a malicious operator to take control of the ROS logic and correspondingly, the complete robot given that MiR's operations are centered around the framework (ROS).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aliasrobotics ≫ Mir100 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir100 Version -
Aliasrobotics ≫ Mir200 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir200 Version -
Aliasrobotics ≫ Mir250 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir250 Version -
Aliasrobotics ≫ Mir500 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir500 Version -
Aliasrobotics ≫ Mir1000 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir1000 Version -
Enabled-robotics ≫ Er-lite Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-lite Version -
Enabled-robotics ≫ Er-flex Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-flex Version -
Enabled-robotics ≫ Er-one Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-one Version -
Uvd-robots ≫ Uvd Robots Firmware Version <= 2.8.1.1
   Uvd-robots ≫ Uvd Robots Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.77% 0.752
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
cve@aliasrobotics.com 10 3.9 6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://github.com/aliasrobotics/RVD/issues/2555
Third Party Advisory
Exploit