CVE-2020-10277: fallo de gravedad media en Mobile Industrial Robots A/S MiR100
RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.4%
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Productos afectados
Mobile Industrial Robots A/S · MiR100CVEs relacionadas — Mobile Industrial Robots A/S MiR100
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-10272CRITICALRVD#2554: MiR ROS computational graph presents no authentication mechanismsEPSS 2.5%CVE-2020-10271CRITICALRVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired onesEPSS 1.8%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2020-10276CRITICALRVD#2558: Default credentials on SICK PLC allows disabling safety featuresEPSS 1.5%CVE-2020-10269CRITICALRVD#2566: Hardcoded Credentials on MiRX00 wireless Access PointEPSS 1.4%CVE-2020-10280HIGHRVD#2568: Apache server is vulnerable to a DoSEPSS 1.2%