Vulnerabilites related to easyrobotics - er-flex
CVE-2020-10276 (GCVE-0-2020-10276)
Vulnerability from cvelistv5
Published
2020-06-24 04:50
Modified
2024-09-16 17:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mobile Industrial Robots A/S | MiR100 |
Version: v2.8.1.1 and before |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:58:39.947Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2558"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MiR100",
"vendor": "Mobile Industrial Robots A/S",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Bernhard Dieber (Joanneum Research)"
}
],
"datePublic": "2020-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-24T04:50:14",
"orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"shortName": "Alias"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2558"
}
],
"source": {
"defect": [
"RVD#2558"
],
"discovery": "EXTERNAL"
},
"title": "RVD#2558: Default credentials on SICK PLC allows disabling safety features",
"x_generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@aliasrobotics.com",
"DATE_PUBLIC": "2020-06-24T04:46:26 +00:00",
"ID": "CVE-2020-10276",
"STATE": "PUBLIC",
"TITLE": "RVD#2558: Default credentials on SICK PLC allows disabling safety features"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MiR100",
"version": {
"version_data": [
{
"version_value": "v2.8.1.1 and before"
}
]
}
}
]
},
"vendor_name": "Mobile Industrial Robots A/S"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Bernhard Dieber (Joanneum Research)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device."
}
]
},
"generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "critical",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aliasrobotics/RVD/issues/2558",
"refsource": "CONFIRM",
"url": "https://github.com/aliasrobotics/RVD/issues/2558"
}
]
},
"source": {
"defect": [
"RVD#2558"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"assignerShortName": "Alias",
"cveId": "CVE-2020-10276",
"datePublished": "2020-06-24T04:50:14.520706Z",
"dateReserved": "2020-03-10T00:00:00",
"dateUpdated": "2024-09-16T17:08:36.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10280 (GCVE-0-2020-10280)
Vulnerability from cvelistv5
Published
2020-06-24 05:45
Modified
2024-09-17 04:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mobile Industrial Robots A/S | MiR100 |
Version: v2.8.1.1 and before |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:58:40.147Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2568"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MiR100",
"vendor": "Mobile Industrial Robots A/S",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lander Usategui (Alias Robotics)"
}
],
"datePublic": "2020-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-239",
"description": "CWE-239",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-24T05:45:13",
"orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"shortName": "Alias"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2568"
}
],
"source": {
"defect": [
"RVD#2568"
],
"discovery": "EXTERNAL"
},
"title": "RVD#2568: Apache server is vulnerable to a DoS",
"x_generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@aliasrobotics.com",
"DATE_PUBLIC": "2020-06-24T05:44:15 +00:00",
"ID": "CVE-2020-10280",
"STATE": "PUBLIC",
"TITLE": "RVD#2568: Apache server is vulnerable to a DoS"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MiR100",
"version": {
"version_data": [
{
"version_value": "v2.8.1.1 and before"
}
]
}
}
]
},
"vendor_name": "Mobile Industrial Robots A/S"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Lander Usategui (Alias Robotics)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard."
}
]
},
"generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "high",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-239"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aliasrobotics/RVD/issues/2568",
"refsource": "CONFIRM",
"url": "https://github.com/aliasrobotics/RVD/issues/2568"
}
]
},
"source": {
"defect": [
"RVD#2568"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"assignerShortName": "Alias",
"cveId": "CVE-2020-10280",
"datePublished": "2020-06-24T05:45:13.897942Z",
"dateReserved": "2020-03-10T00:00:00",
"dateUpdated": "2024-09-17T04:09:28.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10275 (GCVE-0-2020-10275)
Vulnerability from cvelistv5
Published
2020-06-24 05:00
Modified
2024-09-16 20:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mobile Industrial Robots A/S | MiR100 |
Version: v2.8.1.1 and before |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:58:40.132Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2565"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MiR100",
"vendor": "Mobile Industrial Robots A/S",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alias Robotics (group, https://aliasrobotics.com)"
}
],
"datePublic": "2020-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-261",
"description": "CWE-261",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-24T05:00:26",
"orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"shortName": "Alias"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2565"
}
],
"source": {
"defect": [
"RVD#2565"
],
"discovery": "EXTERNAL"
},
"title": "RVD#2565: Weak token generation for the REST API.",
"x_generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@aliasrobotics.com",
"DATE_PUBLIC": "2020-06-24T04:56:23 +00:00",
"ID": "CVE-2020-10275",
"STATE": "PUBLIC",
"TITLE": "RVD#2565: Weak token generation for the REST API."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MiR100",
"version": {
"version_data": [
{
"version_value": "v2.8.1.1 and before"
}
]
}
}
]
},
"vendor_name": "Mobile Industrial Robots A/S"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Alias Robotics (group, https://aliasrobotics.com)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data."
}
]
},
"generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "critical",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-261"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aliasrobotics/RVD/issues/2565",
"refsource": "CONFIRM",
"url": "https://github.com/aliasrobotics/RVD/issues/2565"
}
]
},
"source": {
"defect": [
"RVD#2565"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"assignerShortName": "Alias",
"cveId": "CVE-2020-10275",
"datePublished": "2020-06-24T05:00:26.620330Z",
"dateReserved": "2020-03-10T00:00:00",
"dateUpdated": "2024-09-16T20:31:47.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10277 (GCVE-0-2020-10277)
Vulnerability from cvelistv5
Published
2020-06-24 04:55
Modified
2024-09-17 02:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mobile Industrial Robots A/S | MiR100 |
Version: v2.8.1.1 and before |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:58:39.943Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2562"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MiR100",
"vendor": "Mobile Industrial Robots A/S",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Lander Usategui, Alfonso Glera (Alias Robotics)"
}
],
"datePublic": "2020-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-656",
"description": "CWE-656",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-24T04:55:17",
"orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"shortName": "Alias"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2562"
}
],
"source": {
"defect": [
"RVD#2562"
],
"discovery": "EXTERNAL"
},
"title": "RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation",
"x_generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@aliasrobotics.com",
"DATE_PUBLIC": "2020-06-24T04:53:02 +00:00",
"ID": "CVE-2020-10277",
"STATE": "PUBLIC",
"TITLE": "RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MiR100",
"version": {
"version_data": [
{
"version_value": "v2.8.1.1 and before"
}
]
}
}
]
},
"vendor_name": "Mobile Industrial Robots A/S"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Lander Usategui, Alfonso Glera (Alias Robotics)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine."
}
]
},
"generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "medium",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-656"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aliasrobotics/RVD/issues/2562",
"refsource": "CONFIRM",
"url": "https://github.com/aliasrobotics/RVD/issues/2562"
}
]
},
"source": {
"defect": [
"RVD#2562"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"assignerShortName": "Alias",
"cveId": "CVE-2020-10277",
"datePublished": "2020-06-24T04:55:17.409872Z",
"dateReserved": "2020-03-10T00:00:00",
"dateUpdated": "2024-09-17T02:27:32.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-10274 (GCVE-0-2020-10274)
Vulnerability from cvelistv5
Published
2020-06-24 04:40
Modified
2024-09-17 00:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mobile Industrial Robots A/S | MiR100 |
Version: v2.8.1.1 and before |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:58:40.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2556"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MiR100",
"vendor": "Mobile Industrial Robots A/S",
"versions": [
{
"status": "affected",
"version": "v2.8.1.1 and before"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alias Robotics (group, https://aliasrobotics.com)"
}
],
"datePublic": "2020-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot\u0027s database."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-24T04:40:12",
"orgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"shortName": "Alias"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2556"
}
],
"source": {
"defect": [
"RVD#2556"
],
"discovery": "EXTERNAL"
},
"title": "RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)",
"x_generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@aliasrobotics.com",
"DATE_PUBLIC": "2020-06-24T04:37:43 +00:00",
"ID": "CVE-2020-10274",
"STATE": "PUBLIC",
"TITLE": "RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps)"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MiR100",
"version": {
"version_data": [
{
"version_value": "v2.8.1.1 and before"
}
]
}
}
]
},
"vendor_name": "Mobile Industrial Robots A/S"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Alias Robotics (group, https://aliasrobotics.com)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot\u0027s database."
}
]
},
"generator": {
"engine": "Robot Vulnerability Database (RVD)"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "high",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/aliasrobotics/RVD/issues/2556",
"refsource": "CONFIRM",
"url": "https://github.com/aliasrobotics/RVD/issues/2556"
}
]
},
"source": {
"defect": [
"RVD#2556"
],
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "dc524f69-879d-41dc-ab8f-724e78658a1a",
"assignerShortName": "Alias",
"cveId": "CVE-2020-10274",
"datePublished": "2020-06-24T04:40:12.678203Z",
"dateReserved": "2020-03-10T00:00:00",
"dateUpdated": "2024-09-17T00:05:33.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2020-06-24 05:15
Modified
2024-11-21 04:55
Severity ?
Summary
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@aliasrobotics.com | https://github.com/aliasrobotics/RVD/issues/2562 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/aliasrobotics/RVD/issues/2562 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C1ED80A-1AE1-4868-AD13-F37079F69B60",
"versionEndIncluding": "2.8.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11F1060F-0F43-4920-A05D-593E784B1A0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E52858B-51DE-44BC-A4BB-D199F1281D72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F19DD45-1C6E-498C-A961-5EDB4823B12C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44C6FCBE-E111-419E-8F8D-2F4702D821BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171A2B04-114B-4C5F-9F2C-515A1E37F300",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C86EB588-CD48-456B-90C6-C482636508AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42AB077F-A829-4A9F-8AFF-CBC9222EAE55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C275F303-4494-4C06-95CC-8969E01F8ADA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68599AB3-679D-4E86-B8F4-7939A0373EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53543812-4D0D-4191-8B21-803D2F9790B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1252DDB6-D090-499B-B505-E17625DB88AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D84C826-05A4-44A6-BD12-77805A993A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29230027-8A11-48CA-A4E5-63953EB7CAE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FFA6B9-1A77-4C25-8120-6844B8700527",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C870ABF-C324-442E-9738-025397CB3C47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87684074-A107-4FE3-A840-C5CB3B8025AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine."
},
{
"lang": "es",
"value": "No presenta ning\u00fan mecanismo que impida a un operador malo arrancar desde una imagen de Sistema Operativo en vivo, esto puede conllevar a una extracci\u00f3n de archivos confidenciales (como el archivo shadow) o una escalada de privilegios al a\u00f1adir manualmente un nuevo usuario con privilegios de sudo en la m\u00e1quina"
}
],
"id": "CVE-2020-10277",
"lastModified": "2024-11-21T04:55:07.380",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 0.9,
"impactScore": 5.5,
"source": "cve@aliasrobotics.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-24T05:15:13.347",
"references": [
{
"source": "cve@aliasrobotics.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2562"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2562"
}
],
"sourceIdentifier": "cve@aliasrobotics.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-656"
}
],
"source": "cve@aliasrobotics.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-24 05:15
Modified
2024-11-21 04:55
Severity ?
Summary
The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@aliasrobotics.com | https://github.com/aliasrobotics/RVD/issues/2565 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/aliasrobotics/RVD/issues/2565 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C1ED80A-1AE1-4868-AD13-F37079F69B60",
"versionEndIncluding": "2.8.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11F1060F-0F43-4920-A05D-593E784B1A0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E52858B-51DE-44BC-A4BB-D199F1281D72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F19DD45-1C6E-498C-A961-5EDB4823B12C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44C6FCBE-E111-419E-8F8D-2F4702D821BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171A2B04-114B-4C5F-9F2C-515A1E37F300",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C86EB588-CD48-456B-90C6-C482636508AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42AB077F-A829-4A9F-8AFF-CBC9222EAE55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C275F303-4494-4C06-95CC-8969E01F8ADA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68599AB3-679D-4E86-B8F4-7939A0373EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53543812-4D0D-4191-8B21-803D2F9790B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1252DDB6-D090-499B-B505-E17625DB88AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D84C826-05A4-44A6-BD12-77805A993A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29230027-8A11-48CA-A4E5-63953EB7CAE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FFA6B9-1A77-4C25-8120-6844B8700527",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C870ABF-C324-442E-9738-025397CB3C47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87684074-A107-4FE3-A840-C5CB3B8025AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The access tokens for the REST API are directly derived from the publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated directly with base64(USERNAME:sha256(PASSWORD)). An unauthorized attacker inside the network can use the default credentials to compute the token and interact with the REST API to exfiltrate, infiltrate or delete data."
},
{
"lang": "es",
"value": "Los tokens de acceso para la API REST son derivados directamente desde las credenciales predeterminadas disponibles p\u00fablicamente para la interfaz web. Dado un NOMBRE DE USUARIO y una CONTRASE\u00d1A, la cadena de token est\u00e1 generada directamente con base64(USERNAME:sha256(PASSWORD)). Un atacante no autorizado dentro de la red puede utilizar las credenciales predeterminadas para calcular el token e interactuar con la API REST para filtrar, infiltrar o eliminar datos"
}
],
"id": "CVE-2020-10275",
"lastModified": "2024-11-21T04:55:07.113",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "cve@aliasrobotics.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-24T05:15:13.193",
"references": [
{
"source": "cve@aliasrobotics.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2565"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2565"
}
],
"sourceIdentifier": "cve@aliasrobotics.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-261"
}
],
"source": "cve@aliasrobotics.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-326"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-24 05:15
Modified
2024-11-21 04:55
Severity ?
Summary
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@aliasrobotics.com | https://github.com/aliasrobotics/RVD/issues/2556 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/aliasrobotics/RVD/issues/2556 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C1ED80A-1AE1-4868-AD13-F37079F69B60",
"versionEndIncluding": "2.8.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11F1060F-0F43-4920-A05D-593E784B1A0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E52858B-51DE-44BC-A4BB-D199F1281D72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F19DD45-1C6E-498C-A961-5EDB4823B12C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44C6FCBE-E111-419E-8F8D-2F4702D821BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171A2B04-114B-4C5F-9F2C-515A1E37F300",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C86EB588-CD48-456B-90C6-C482636508AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42AB077F-A829-4A9F-8AFF-CBC9222EAE55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C275F303-4494-4C06-95CC-8969E01F8ADA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68599AB3-679D-4E86-B8F4-7939A0373EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53543812-4D0D-4191-8B21-803D2F9790B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1252DDB6-D090-499B-B505-E17625DB88AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D84C826-05A4-44A6-BD12-77805A993A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29230027-8A11-48CA-A4E5-63953EB7CAE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FFA6B9-1A77-4C25-8120-6844B8700527",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C870ABF-C324-442E-9738-025397CB3C47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87684074-A107-4FE3-A840-C5CB3B8025AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot\u0027s database."
},
{
"lang": "es",
"value": "Los tokens de acceso para la API REST son derivados directamente (codificaci\u00f3n sha256 y base64) de las credenciales predeterminadas disponibles p\u00fablicamente del Panel de Control (consulte CVE-2020-10270 para conocer los fallos relacionados). Este fallo en combinaci\u00f3n con CVE-2020-10273 permite a cualquier atacante conectado a las redes del robot (por cable o inal\u00e1mbrico) extraer todos los datos almacenados (por ejemplo, im\u00e1genes de mapeo en interiores) y metadatos asociados de la base de datos del robot"
}
],
"id": "CVE-2020-10274",
"lastModified": "2024-11-21T04:55:06.977",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"source": "cve@aliasrobotics.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-24T05:15:13.113",
"references": [
{
"source": "cve@aliasrobotics.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2556"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2556"
}
],
"sourceIdentifier": "cve@aliasrobotics.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "cve@aliasrobotics.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-330"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-24 05:15
Modified
2024-11-21 04:55
Severity ?
Summary
The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@aliasrobotics.com | https://github.com/aliasrobotics/RVD/issues/2558 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/aliasrobotics/RVD/issues/2558 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C1ED80A-1AE1-4868-AD13-F37079F69B60",
"versionEndIncluding": "2.8.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11F1060F-0F43-4920-A05D-593E784B1A0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E52858B-51DE-44BC-A4BB-D199F1281D72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F19DD45-1C6E-498C-A961-5EDB4823B12C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44C6FCBE-E111-419E-8F8D-2F4702D821BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171A2B04-114B-4C5F-9F2C-515A1E37F300",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C86EB588-CD48-456B-90C6-C482636508AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42AB077F-A829-4A9F-8AFF-CBC9222EAE55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C275F303-4494-4C06-95CC-8969E01F8ADA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68599AB3-679D-4E86-B8F4-7939A0373EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53543812-4D0D-4191-8B21-803D2F9790B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1252DDB6-D090-499B-B505-E17625DB88AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D84C826-05A4-44A6-BD12-77805A993A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29230027-8A11-48CA-A4E5-63953EB7CAE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FFA6B9-1A77-4C25-8120-6844B8700527",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C870ABF-C324-442E-9738-025397CB3C47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87684074-A107-4FE3-A840-C5CB3B8025AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, effectively disabling the emergency stop in case an object is too close to the robot. Navigation and any other components dependent on the laser scanner are not affected (thus it is hard to detect before something happens) though the laser scanner configuration can also be affected altering further the safety of the device."
},
{
"lang": "es",
"value": "La contrase\u00f1a para el PLC de seguridad es la predeterminada y, por lo tanto, f\u00e1cil de encontrar (en manuales, etc.). Esto permite a un programa manipulado ser cargado al PLC de seguridad, deshabilitando efectivamente la parada de emergencia en caso de que un objeto est\u00e9 demasiado cerca del robot. Una navegaci\u00f3n y cualquier otro componente dependiente del esc\u00e1ner l\u00e1ser no est\u00e1n afectados (por lo tanto, es dif\u00edcil de detectar antes de que ocurra algo), aunque la configuraci\u00f3n del esc\u00e1ner l\u00e1ser puede tambi\u00e9n estar afectada alterando a\u00fan m\u00e1s la seguridad del dispositivo"
}
],
"id": "CVE-2020-10276",
"lastModified": "2024-11-21T04:55:07.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "cve@aliasrobotics.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-24T05:15:13.270",
"references": [
{
"source": "cve@aliasrobotics.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2558"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2558"
}
],
"sourceIdentifier": "cve@aliasrobotics.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "cve@aliasrobotics.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-24 06:15
Modified
2024-11-21 04:55
Severity ?
Summary
The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@aliasrobotics.com | https://github.com/aliasrobotics/RVD/issues/2568 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/aliasrobotics/RVD/issues/2568 | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C1ED80A-1AE1-4868-AD13-F37079F69B60",
"versionEndIncluding": "2.8.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11F1060F-0F43-4920-A05D-593E784B1A0B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E52858B-51DE-44BC-A4BB-D199F1281D72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0F7F08-D5D5-4DA8-B2B2-5EA2997AEE3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir250_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F19DD45-1C6E-498C-A961-5EDB4823B12C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir250:-:*:*:*:*:*:*:*",
"matchCriteriaId": "44C6FCBE-E111-419E-8F8D-2F4702D821BA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir500_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C63DB5B-961D-4FDD-AB12-01DC24AFC0B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2BC5C9E-1AF3-4009-844E-6E64E4D766A8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mobile-industrial-robots:mir1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "171A2B04-114B-4C5F-9F2C-515A1E37F300",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mobile-industrial-robots:mir1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C86EB588-CD48-456B-90C6-C482636508AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er200_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42AB077F-A829-4A9F-8AFF-CBC9222EAE55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C275F303-4494-4C06-95CC-8969E01F8ADA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-lite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68599AB3-679D-4E86-B8F4-7939A0373EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-lite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "53543812-4D0D-4191-8B21-803D2F9790B6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-flex_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1252DDB6-D090-499B-B505-E17625DB88AC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-flex:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9D84C826-05A4-44A6-BD12-77805A993A5D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:easyrobotics:er-one_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "29230027-8A11-48CA-A4E5-63953EB7CAE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:easyrobotics:er-one:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7FFA6B9-1A77-4C25-8120-6844B8700527",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:uvd-robots:uvd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C870ABF-C324-442E-9738-025397CB3C47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:uvd-robots:uvd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87684074-A107-4FE3-A840-C5CB3B8025AC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Apache server on port 80 that host the web interface is vulnerable to a DoS by spamming incomplete HTTP headers, effectively blocking the access to the dashboard."
},
{
"lang": "es",
"value": "El servidor Apache en el puerto 80 que aloja la interfaz web es vulnerable a un ataque de tipo DoS mediante un correo no deseado de encabezados HTTP incompletos, bloqueando efectivamente el acceso al panel"
}
],
"id": "CVE-2020-10280",
"lastModified": "2024-11-21T04:55:07.783",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "cve@aliasrobotics.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-24T06:15:11.620",
"references": [
{
"source": "cve@aliasrobotics.com",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2568"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/aliasrobotics/RVD/issues/2568"
}
],
"sourceIdentifier": "cve@aliasrobotics.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-239"
}
],
"source": "cve@aliasrobotics.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-404"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}