Lucene search

[email protected]CVE-2020-10279

HistoryJun 24, 2020 - 6:15 a.m.

CVE-2020-10279

2020-06-2406:15:11

CWE-276

CWE-1188

CWE-362

[email protected]

web.nvd.nist.gov

cve-2020-10279

mir robot controllers

ubuntu 16.04.2

access escalation

race conditions

insecure configurations

dos attacks

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

MiR robot controllers (central computation unit) makes use of Ubuntu 16.04.2 an operating system, Thought for desktop uses, this operating system presents insecure defaults for robots. These insecurities include a way for users to escalate their access beyond what they were granted via file creation, access race conditions, insecure home directory configurations and defaults that facilitate Denial of Service (DoS) attacks.

Affected configurations

NVD

Node

aliasroboticsmir100_firmwareRange≤2.8.1.1

AND

aliasroboticsmir100Match-

Node

aliasroboticsmir200_firmwareRange≤2.8.1.1

AND

aliasroboticsmir200Match-

Node

aliasroboticsmir250_firmwareRange≤2.8.1.1

AND

aliasroboticsmir250Match-

Node

aliasroboticsmir500_firmwareRange≤2.8.1.1

AND

aliasroboticsmir500Match-

Node

aliasroboticsmir1000_firmwareRange≤2.8.1.1

AND

aliasroboticsmir1000Match-

Node

mobile-industrial-roboticser200_firmwareRange≤2.8.1.1

AND

mobile-industrial-roboticser200Match-

Node

enabled-roboticser-lite_firmwareRange≤2.8.1.1

AND

enabled-roboticser-liteMatch-

Node

enabled-roboticser-flex_firmwareRange≤2.8.1.1

AND

enabled-roboticser-flexMatch-

Node

enabled-roboticser-one_firmwareRange≤2.8.1.1

AND

enabled-roboticser-oneMatch-

Node

uvd-robotsuvd_robots_firmwareRange≤2.8.1.1

AND

uvd-robotsuvd_robotsMatch-

CPENameOperatorVersion
aliasrobotics:mir100_firmwarealiasrobotics mir100 firmwarele2.8.1.1

CPE	Name	Operator	Version
aliasrobotics:mir100_firmware	aliasrobotics mir100 firmware	le	2.8.1.1

CNA Affected

[
  {
    "product": "MiR100",
    "vendor": "Mobile Industrial Robots A/S",
    "versions": [
      {
        "status": "affected",
        "version": "v2.8.1.1 and before"
      }
    ]
  }
]

References

github.com/aliasrobotics/RVD/issues/2569

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

Related for CVE-2020-10279

nvd1 cvelist1 prion1 ics1