CVE-2020-10274
This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The access tokens for the REST API are directly derived (sha256 and base64 encoding) from the publicly available default credentials from the Control Dashboard (refer to CVE-2020-10270 for related flaws). This flaw in combination with CVE-2020-10273 allows any attacker connected to the robot networks (wired or wireless) to exfiltrate all stored data (e.g. indoor mapping images) and associated metadata from the robot's database.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-330
- Affected
- mobile-industrial-robots/mir100 firmware · mobile-industrial-robots/mir200 firmware · mobile-industrial-robots/mir250 firmware · mobile-industrial-robots/mir500 firmware · mobile-industrial-robots/mir1000 firmware · easyrobotics/er200 firmware · easyrobotics/er-lite firmware · easyrobotics/er-flex firmware · easyrobotics/er-one firmware · uvd-robots/uvd firmware
- Source
- cve@aliasrobotics.com
References
- https://github.com/aliasrobotics/RVD/issues/2556Third Party Advisory
- https://github.com/aliasrobotics/RVD/issues/2556Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.