Lucene search

[email protected]CVE-2020-10272

HistoryJun 24, 2020 - 5:15 a.m.

CVE-2020-10272

2020-06-2405:15:00

CWE-306

[email protected]

web.nvd.nist.gov

mir100

mir200

robots

ros

default packages

authentication

cve-2020-10272

security vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.005 Low

EPSS

Percentile

76.7%

JSON

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

CPENameOperatorVersion
aliasrobotics:mir100_firmwarealiasrobotics mir100 firmwarele2.8.1.1
aliasrobotics:mir200_firmwarealiasrobotics mir200 firmwarele2.8.1.1
aliasrobotics:mir250_firmwarealiasrobotics mir250 firmwarele2.8.1.1
aliasrobotics:mir500_firmwarealiasrobotics mir500 firmwarele2.8.1.1
aliasrobotics:mir1000_firmwarealiasrobotics mir1000 firmwarele2.8.1.1
mobile-industrial-robotics:er200_firmwaremobile-industrial-robotics er200 firmwarele2.8.1.1
enabled-robotics:er-lite_firmwareenabled-robotics er-lite firmwarele2.8.1.1
enabled-robotics:er-flex_firmwareenabled-robotics er-flex firmwarele2.8.1.1
enabled-robotics:er-one_firmwareenabled-robotics er-one firmwarele2.8.1.1
uvd-robots:uvd_robots_firmwareuvd-robots uvd robots firmwarele2.8.1.1

CPE	Name	Operator	Version
aliasrobotics:mir100_firmware	aliasrobotics mir100 firmware	le	2.8.1.1
aliasrobotics:mir200_firmware	aliasrobotics mir200 firmware	le	2.8.1.1
aliasrobotics:mir250_firmware	aliasrobotics mir250 firmware	le	2.8.1.1
aliasrobotics:mir500_firmware	aliasrobotics mir500 firmware	le	2.8.1.1
aliasrobotics:mir1000_firmware	aliasrobotics mir1000 firmware	le	2.8.1.1
mobile-industrial-robotics:er200_firmware	mobile-industrial-robotics er200 firmware	le	2.8.1.1
enabled-robotics:er-lite_firmware	enabled-robotics er-lite firmware	le	2.8.1.1
enabled-robotics:er-flex_firmware	enabled-robotics er-flex firmware	le	2.8.1.1
enabled-robotics:er-one_firmware	enabled-robotics er-one firmware	le	2.8.1.1
uvd-robots:uvd_robots_firmware	uvd-robots uvd robots firmware	le	2.8.1.1

References

github.com/aliasrobotics/RVD/issues/2554

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.005 Low

EPSS

Percentile

76.7%

JSON

Related for CVE-2020-10272

prion3 cve2 ics1