9.8

CVE-2020-10275

The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.

Data is provided by the National Vulnerability Database (NVD)
Mobile-industrial-robots ≫ Mir100 Firmware Version <= 2.8.1.1
   Mobile-industrial-robots ≫ Mir100 Version-
Easyrobotics ≫ Er200 Firmware Version-
   Easyrobotics ≫ Er200 Version-
Easyrobotics ≫ Er-lite Firmware Version-
   Easyrobotics ≫ Er-lite Version-
Easyrobotics ≫ Er-flex Firmware Version-
   Easyrobotics ≫ Er-flex Version-
Easyrobotics ≫ Er-one Firmware Version-
   Easyrobotics ≫ Er-one Version-
Uvd-robots ≫ Uvd Firmware Version-
   Uvd-robots ≫ Uvd Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.17% 0.348
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
cve@aliasrobotics.com 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-261 Weak Encoding for Password

Obscuring a password with a trivial encoding does not protect the password.

CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.