10
CVE-2020-10271
- EPSS 0.44%
- Published 24.06.2020 05:15:12
- Last modified 21.11.2024 04:55:06
- Source cve@aliasrobotics.com
- Teams watchlist Login
- Open Login
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces, wireless and wired. This is the result of a bad set up and can be mitigated by appropriately configuring ROS and/or applying custom patches as appropriate. Currently, the ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws such as CVE-2020-10269, the computation graph can also be fetched and interacted from wireless networks. This allows a malicious operator to take control of the ROS logic and correspondingly, the complete robot given that MiR's operations are centered around the framework (ROS).
Data is provided by the National Vulnerability Database (NVD)
Aliasrobotics ≫ Mir100 Firmware Version <= 2.8.1.1
Aliasrobotics ≫ Mir200 Firmware Version <= 2.8.1.1
Aliasrobotics ≫ Mir250 Firmware Version <= 2.8.1.1
Aliasrobotics ≫ Mir500 Firmware Version <= 2.8.1.1
Aliasrobotics ≫ Mir1000 Firmware Version <= 2.8.1.1
Mobile-industrial-robotics ≫ Er200 Firmware Version <= 2.8.1.1
Enabled-robotics ≫ Er-lite Firmware Version <= 2.8.1.1
Enabled-robotics ≫ Er-flex Firmware Version <= 2.8.1.1
Enabled-robotics ≫ Er-one Firmware Version <= 2.8.1.1
Uvd-robots ≫ Uvd Robots Firmware Version <= 2.8.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.44% | 0.602 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| cve@aliasrobotics.com | 10 | 3.9 | 6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
CWE-668 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.