PT-2020-12021 · Mobile Industrial Robots A/S+4 · Mir100+10

Alfonso Glera + 4 · Publicado 2020-06-24 · Atualizado 2020-07-06 · CVE-2020-10272

NVD

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2020-10272

Produtos afetados

Mir100

Er-Flex Firmware

Er-Lite Firmware

Er-One Firmware

Er200 Firmware

Mir1000 Firmware

Mir100 Firmware

Mir200 Firmware

Mir250 Firmware

Mir500 Firmware

Uvd Robots Firmware

Referências · 5

• 🔥 https://github.com/aliasrobotics/RVD/issues/2554 · Exploit
• https://osv.dev/vulnerability/CVE-2020-10272 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-10272 · Nota de Segurança
• https://t.me/cvenotify/4612 · Publicação no Telegram
• https://t.me/cibsecurity/13028 · Publicação no Telegram