9.8

CVE-2020-10279

RVD#2569: Insecure operating system defaults in MiR robots

MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aliasrobotics ≫ Mir100 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir100 Version -
Aliasrobotics ≫ Mir200 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir200 Version -
Aliasrobotics ≫ Mir250 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir250 Version -
Aliasrobotics ≫ Mir500 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir500 Version -
Aliasrobotics ≫ Mir1000 Firmware Version <= 2.8.1.1
   Aliasrobotics ≫ Mir1000 Version -
Enabled-robotics ≫ Er-lite Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-lite Version -
Enabled-robotics ≫ Er-flex Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-flex Version -
Enabled-robotics ≫ Er-one Firmware Version <= 2.8.1.1
   Enabled-robotics ≫ Er-one Version -
Uvd-robots ≫ Uvd Robots Firmware Version <= 2.8.1.1
   Uvd-robots ≫ Uvd Robots Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.97% 0.581
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
cve@aliasrobotics.com 10 3.9 6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://github.com/aliasrobotics/RVD/issues/2569
Third Party Advisory