CVE-2020-10277: falha de média gravidade em Mobile Industrial Robots A/S MiR100
RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.4%
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Produtos afetados
Mobile Industrial Robots A/S · MiR100CVEs relacionadas — Mobile Industrial Robots A/S MiR100
No mesmo produto, das mais perigosas para as menos.
CVE-2020-10272CRITICALRVD#2554: MiR ROS computational graph presents no authentication mechanismsEPSS 2.5%CVE-2020-10271CRITICALRVD#2555: MiR ROS computational graph is exposed to all network interfaces, including poorly secured wireless networks and open wired onesEPSS 1.8%CVE-2020-10270CRITICALRVD#2557: Hardcoded Credentials on MiRX00 Control DashboardEPSS 1.7%CVE-2020-10276CRITICALRVD#2558: Default credentials on SICK PLC allows disabling safety featuresEPSS 1.5%CVE-2020-10269CRITICALRVD#2566: Hardcoded Credentials on MiRX00 wireless Access PointEPSS 1.4%CVE-2020-10280HIGHRVD#2568: Apache server is vulnerable to a DoSEPSS 1.2%