PT-2020-12024 · Mobile Industrial Robots A/S+3 · Mir100+10

Alias Robotics + 1 · Published 2020-06-24 · Updated 2020-07-02 · CVE-2020-10275

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software name or affected versions are mentioned in the provided descriptions.

Description The issue concerns the generation of access tokens for a REST API, which are directly derived from publicly available default credentials for the web interface. Given a USERNAME and a PASSWORD, the token string is generated using base64(USERNAME:sha256(PASSWORD)). This allows an unauthorized attacker inside the network to compute the token and interact with the REST API, potentially leading to data exfiltration, infiltration, or deletion.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-261

CWE-326

Related Identifiers

CVE-2020-10275

Affected Products

Mir100

Er-Flex Firmware

Er-Lite Firmware

Er-One Firmware

Er200 Firmware

Mir1000 Firmware

Mir100 Firmware

Mir200 Firmware

Mir250 Firmware

Mir500 Firmware

Uvd Firmware

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10275 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10275 · Vendor Advisory
• https://github.com/aliasrobotics/RVD/issues/2565 · Note
• https://t.me/cvenotify/4615 · Telegram Post
• https://t.me/cibsecurity/13025 · Telegram Post