CVE-2020-10276: critical vulnerability in Mobile Industrial Robots A/S MiR100
RVD#2558: Default credentials on SICK PLC allows disabling safety features
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.5%
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Mobile Industrial Robots A/S · MiR100Related CVEs — Mobile Industrial Robots A/S MiR100
In the same product, most dangerous first.
CVE-2020-10272CRITICALRVD#2554: MiR ROS computational graph presents no authentication mechanismsEPSS 2.5%CVE-2020-10271CRITICALRVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired onesEPSS 1.8%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2020-10269CRITICALRVD#2566: Hardcoded Credentials on MiRX00 wireless Access PointEPSS 1.4%CVE-2020-10280HIGHRVD#2568: Apache server is vulnerable to a DoSEPSS 1.2%CVE-2020-10279CRITICALRVD#2569: Insecure operating system defaults in MiR robotsEPSS 1.0%