CVE-2020-10272: critical vulnerability in Mobile Industrial Robots A/S MiR100
RVD#2554: MiR ROS computational graph presents no authentication mechanisms
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 2.5%
MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Mobile Industrial Robots A/S · MiR100Related CVEs — Mobile Industrial Robots A/S MiR100
In the same product, most dangerous first.
CVE-2020-10271CRITICALRVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired onesEPSS 1.8%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2020-10276CRITICALRVD#2558: Default credentials on SICK PLC allows disabling safety featuresEPSS 1.5%CVE-2020-10269CRITICALRVD#2566: Hardcoded Credentials on MiRX00 wireless Access PointEPSS 1.4%CVE-2020-10280HIGHRVD#2568: Apache server is vulnerable to a DoSEPSS 1.2%CVE-2020-10279CRITICALRVD#2569: Insecure operating system defaults in MiR robotsEPSS 1.0%