10

CVE-2020-10272

Exploit

RVD#2554: MiR ROS computational graph presents no authentication mechanisms

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aliasrobotics ≫ Mir100 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir100 Version -
Aliasrobotics ≫ Mir200 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir200 Version -
Aliasrobotics ≫ Mir250 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir250 Version -
Aliasrobotics ≫ Mir500 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir500 Version -
Aliasrobotics ≫ Mir1000 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir1000 Version -
Enabled-robotics ≫ Er-lite Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-lite Version -
Enabled-robotics ≫ Er-flex Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-flex Version -
Enabled-robotics ≫ Er-one Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-one Version -
Uvd-robots ≫ Uvd Robots Firmware Version <= 2.8.1.1
   Uvd-robots ≫ Uvd Robots Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.46% 0.823
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
cve@aliasrobotics.com 10 3.9 6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/aliasrobotics/RVD/issues/2554
Third Party Advisory
Exploit