Lander Usategui

**Name of the Vulnerable Software and Affected Versions** MiR100, MiR200 and other MiR robots (affected versions not specified) **Description** The issue is related to the Robot Operating System (ROS) default packages exposing the computational graph to all network interfaces. This exposure is due to a bad setup and can be exploited by malicious operators to take control of the ROS logic and, consequently, the complete robot. The ROS computational graph can be accessed fully from the wired exposed ports. In combination with other flaws, the computational graph can also be fetched and interacted with from wireless networks. **Recommendations** For MiR100, MiR200 and other MiR robots, appropriately configure ROS to mitigate the issue. Apply custom patches as appropriate to secure the ROS computational graph. Restrict access to the wired exposed ports to minimize the risk of exploitation. Consider disabling unnecessary network interfaces to reduce the attack surface until a proper configuration or patch is applied.

MiR100, MiR200 and other MiR robots use the Robot Operating System (ROS) default packages exposing the computational graph without any sort of authentication. This allows attackers with access to the internal wireless and wired networks to take control of the robot seamlessly. In combination with CVE-2020-10269 and CVE-2020-10271, this flaw allows malicious actors to command the robot at desire.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue is related to the lack of a mechanism to prevent booting from a live OS image, which can lead to the extraction of sensitive files, such as the shadow file, or privilege escalation by manually adding a new user with sudo privileges on the machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MiR's Computer (affected versions not specified) **Description** The BIOS onboard MiR's Computer is not protected by a password, allowing a malicious operator to modify settings such as boot order. This can be leveraged to boot from a Live Image. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server (affected versions not specified) **Description** The issue allows for a denial-of-service (DoS) attack by spamming incomplete HTTP headers to the Apache server on port 80, which hosts the web interface, effectively blocking access to the dashboard. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.