7.1

CVE-2020-10274

The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.

Data is provided by the National Vulnerability Database (NVD)
Mobile-industrial-robots ≫ Mir100 Firmware Version <= 2.8.1.1
   Mobile-industrial-robots ≫ Mir100 Version-
Easyrobotics ≫ Er200 Firmware Version-
   Easyrobotics ≫ Er200 Version-
Easyrobotics ≫ Er-lite Firmware Version-
   Easyrobotics ≫ Er-lite Version-
Easyrobotics ≫ Er-flex Firmware Version-
   Easyrobotics ≫ Er-flex Version-
Easyrobotics ≫ Er-one Firmware Version-
   Easyrobotics ≫ Er-one Version-
Uvd-robots ≫ Uvd Firmware Version-
   Uvd-robots ≫ Uvd Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.28% 0.483
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
cve@aliasrobotics.com 7.1 2.8 4.2
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.